What is the CVSS score of CVE-2025-43718?

CVE-2025-43718 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-43718?

CVE-2025-43718 is a low-severity vulnerability in Poppler 24.06.1 through 25.x before 25.04.0 (CVSS 2.9).. A patch is available.

How to fix or mitigate CVE-2025-43718?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Ubuntu CVE-2025-43718

EUVD-2025-32701 LOW

Uncontrolled Recursion (CWE-674)

2025-10-01 cve@mitre.org

Information Disclosure Debian Ubuntu

2.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 18:18 euvd

EUVD-2025-32701

Analysis Generated

Mar 13, 2026 - 18:18 vuln.today

CVE Published

Oct 01, 2025 - 19:15 nvd

LOW 2.9

DescriptionCVE.org

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

Analysis

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Uncontrolled Recursion (CWE-674).

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

8.8

CVE-2019-9543 HIGH POC

8.8

CVE-2019-9144 HIGH POC

8.8

CVE-2019-9143 HIGH POC

8.8

CVE-2026-9769 HIGH POC

8.7

CVE-2026-40345 HIGH POC

8.2

CVE-2025-9624 HIGH POC

8.3

CVE-2019-9192 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

Ubuntu

Priority: Medium

poppler

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
plucky	released	25.03.0-3ubuntu1.3
upstream	released	25.03.0-10
jammy	released	22.02.0-2ubuntu0.11
noble	released	24.02.0-1ubuntu9.7
questing	released	25.03.0-10

USN-7803-1

Debian

Bug #1117046

poppler

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	20.09.0-3.1+deb11u1	-
bullseye (security)	vulnerable	20.09.0-3.1+deb11u2	-
bookworm	vulnerable	22.12.0-2+deb12u1	-
trixie	vulnerable	25.03.0-5+deb13u2	-
forky, sid	fixed	25.03.0-11.1	-
(unstable)	fixed	25.03.0-10	-

CVE-2025-43718 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-43718

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-674 – Uncontrolled Recursion

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code