poppler accepts a forged adbe.pkcs7.sha1 signature
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Advisory
- CVE-2025-43903
- Library
- poppler, poppler on Debian
- Published
- Severity
- 3.3 out of 10, as published
- Affected
- poppler before 25.04.0
- Fixed in
- 25.04.0
- Reaches you
- through another call
What triggers it
Asking poppler to verify a document signature (pdfsig or the signature API).
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
Signature verification is a separate call that rendering and pdfinfo never make; a forged signature does not reach a pipeline that only renders pages.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to poppler 25.04.0.
Specifically. Not a pre-decode matter. If signatures are verified, use poppler 25.04.0 or later.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-43903
- The record entry, triaged 2026-11-03, last checked 2026-11-03