CVE-2025-32365

Publication date 7 April 2025

Last updated 30 May 2025

Ubuntu priority

Cvss 3 Severity Score

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
poppler	25.04 plucky	Fixed 25.03.0-3
	24.10 oracular	Fixed 24.08.0-1ubuntu0.2
	24.04 LTS noble	Fixed 24.02.0-1ubuntu9.3
	22.04 LTS jammy	Fixed 22.02.0-2ubuntu0.7
	20.04 LTS focal	Fixed 0.86.1-0ubuntu1.6
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
poppler	Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792 Upstream: 1f15156

Severity score breakdown

Parameter	Value
Base score	4.0 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	Low
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Related Ubuntu Security Notices (USN)

USN-7426-1
poppler vulnerabilities
8 April 2025

USN-7426-2
poppler vulnerabilities
9 April 2025

Other references

https://www.cve.org/CVERecord?id=CVE-2025-32365