Poppler CVE-2025-52885

Exploitation requires that a Poppler-based application (versions prior to 25.10.0) parse an attacker-supplied PDF whose structure-tree content drives StructTreeRoot's refToParentMap to store raw pointers into a std::vector and then triggers a reallocation (vector growth past capacity), invalidating those pointers for a subsequent write. Limiting factors: the attack vector is local (AV:L) - the malicious PDF must be processed on the target host via a viewer or utility such as Evince, Okular, or poppler-utils; no authentication is needed (PR:N); and the vendor marks exploitation unproven (E:U), so while memory corruption is reachable, deterministic control of the UAF-write for code execution is not demonstrated. Environments that never process untrusted PDFs are effectively not exposed.

Signals point to a real but non-urgent issue. The vendor CVSS 4.0 base score is 6.1 (Medium) with a LOCAL attack vector (AV:L) and high vulnerable-system impact (VC:H/VI:H/VA:H), and the vector explicitly carries E:U (Exploit Unproven). EPSS reinforces low near-term exploitation likelihood at 0.17% (6th percentile). There is no CISA KEV listing and no public exploit identified, so this is not confirmed as actively exploited. The key tension is high technical impact versus low exploitability: a use-after-free WRITE (CWE-416) in a C++ memory-management pattern is theoretically powerful (potential code execution), but it is reached only by processing an attacker-crafted PDF locally, and reliable weaponization of a vector-reallocation UAF-write is non-trivial. Note also that the attack vector is AV:L/UI:N: 'local' here means the crafted PDF is processed on the target host (e.g. a server-side converter/thumbnailer or desktop viewer) rather than delivered over a network service - verify how PDFs enter your environment before scoring remote risk. Net: patch on a routine cadence, prioritizing automated PDF-processing pipelines, but this does not warrant emergency response.

An attacker crafts a PDF with a structure tree that causes Poppler's StructTreeRoot to grow its internal std::vector while refToParentMap still holds raw pointers into the old backing array; when the vector reallocates, those pointers dangle and a subsequent write corrupts freed heap memory. A victim application (a PDF viewer such as Evince/Okular, or an unattended converter using poppler-utils) parses the file and triggers the use-after-free, potentially leading to crash or code execution. No public exploit code is known and the vendor marks exploitation as unproven (E:U).