Skip to main content

Ubuntu EUVD-2025-19742

| CVE-2025-52886 MEDIUM
Use After Free (CWE-416)
2025-07-02 security-advisories@github.com
Buffer Overflow Use After Free Memory Corruption Ubuntu Debian Poppler Red Hat Suse
5.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative
Red Hat
4.0 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
EUVD ID Assigned
Mar 16, 2026 - 01:55 euvd
EUVD-2025-19742
Analysis Generated
Mar 16, 2026 - 01:55 vuln.today
Patch released
Mar 16, 2026 - 01:55 nvd
Patch available
PoC Detected
Nov 04, 2025 - 22:16 vuln.today
Public exploit code
CVE Published
Jul 02, 2025 - 16:15 nvd
MEDIUM 5.9

DescriptionGitHub Advisory

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Analysis

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Technical ContextAI

A use-after-free vulnerability occurs when a program continues to use a pointer after the referenced memory has been freed, leading to undefined behavior. This vulnerability is classified as Use After Free (CWE-416).

RemediationAI

A vendor patch is available — apply it immediately. Use memory-safe languages. Implement proper object lifecycle management. Use static and dynamic analysis tools to detect UAF patterns.

Vendor StatusVendor

Ubuntu

Priority: Medium
poppler
Release Status Version
oracular ignored end of life, was needs-triage
upstream released 25.06.0
jammy released 22.02.0-2ubuntu0.9
noble released 24.02.0-1ubuntu9.5
plucky released 25.03.0-3ubuntu1.1
bionic released 0.62.0-2ubuntu2.14+esm7
focal released 0.86.1-0ubuntu1.7+esm1
xenial released 0.41.0-0ubuntu1.16+esm7
USN-7675-1 USN-7687-1

Debian

Bug #1108784
poppler
Release Status Fixed Version Urgency
bullseye vulnerable 20.09.0-3.1+deb11u1 -
bullseye (security) vulnerable 20.09.0-3.1+deb11u2 -
bookworm vulnerable 22.12.0-2+deb12u1 -
trixie fixed 25.03.0-5+deb13u2 -
forky, sid fixed 25.03.0-11.1 -
(unstable) fixed 25.03.0-5 -

SUSE

Severity: Medium
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

Share

EUVD-2025-19742 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy