CVE-2025-32365

Summary

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Affected Software

Weaknesses

• CWE-125: CWE-125 Out-of-bounds Read

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html

References

• https://gitlab.freedesktop.org/poppler/poppler/-/issues/1577
• https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792

• ←Previous
• Next→