Deeply nested PDF metadata exhausts poppler's stack
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string.
- Advisory
- CVE-2025-43718
- Library
- poppler, poppler on Debian
- Published
- Severity
- 2.9 out of 10, as published
- Affected
- poppler 24.06.1 through 25.03
- Fixed in
- 25.04.0
- Reaches you
- by opening a file
What triggers it
A PDF whose metadata (for example a long GTS_PDFEVersion string) drives deep recursion in poppler's regular-expression matching.
What sillybos does
Reaches pdfinfo itself
The flaw is in the PDF parser sillybos asks, in a separate process with a time limit, so a crash or a hang there is one file refused.
In Catalog::getMetadata and the dictionary lookup beneath it, which pdfinfo may run while reporting the metadata. A crash in pdfinfo is a non-zero exit and so a refusal: the check fails closed.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to poppler 25.04.0.
Specifically. Render PDFs in a boxed process with memory and time limits (see Decoding in a box); nothing read before decoding can see this.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-43718
- The record entry, triaged 2026-11-03, last checked 2026-11-03