Tetrak
GitHub ↗
Security

poppler advisories

The PDF renderer behind pdftoppm and pdfinfo, which Tetrak OCR and most Python PDF tools call to turn pages into images

16 advisories recorded for poppler (poppler on Debian); the project is at https://gitlab.freedesktop.org/poppler/poppler. Newest first.

PublishedAdvisoryReaches youWhat sillybos does
A long password overflows the stack when poppler opens an AESV3 PDF CVE-2026-107705through another callRefused by default
Converting an embedded TrueType font overflows an integer in poppler CVE-2026-102620by opening a fileNeeds decoding to detect
A clipping path overflows an integer in poppler's Splash renderer CVE-2026-102621by opening a fileNeeds decoding to detect
poppler's JBIG2Stream::rewind dereferences a null pointer CVE-2026-93312by opening a fileRefused with a setting
An embedded TrueType font's segment count overflows an integer in poppler CVE-2026-93314by opening a fileNeeds decoding to detect
A tiling pattern near the int32 boundary spins poppler's Splash renderer CVE-2026-93653by opening a fileNeeds decoding to detect
A sampled function's BitsPerSample overflows an integer in poppler CVE-2026-93311by opening a fileNeeds decoding to detect
A JBIG2 code table overflows an integer in poppler CVE-2026-93313by opening a fileRefused with a setting
A tiling pattern overflows an allocation in poppler's Splash renderer CVE-2026-10118by opening a fileNeeds decoding to detect
poppler's structure tree holds dangling pointers after a vector resize CVE-2025-52885by opening a fileReaches pdfinfo itself
Deeply nested PDF metadata exhausts poppler's stack CVE-2025-43718by opening a fileReaches pdfinfo itself
pdfseparate recurses without limit on a crafted PDF CVE-2025-50420through a command-line toolNot reached by opening a file
poppler's 32-bit reference count can overflow into a use-after-free CVE-2025-52886by opening a fileReaches pdfinfo itself
poppler accepts a forged adbe.pkcs7.sha1 signature CVE-2025-43903through another callNot reached by opening a file
A PostScript calculator function in a PDF divides by INT_MIN and crashes poppler CVE-2025-32364by opening a fileNeeds decoding to detect
A JBIG2 stream in a PDF reads out of bounds in poppler's JBIG2Bitmap::combine CVE-2025-32365by opening a fileRefused with a setting

Back to the whole watch.