CVE-2025-32365

7.1 highEPSS 0.3%

High (7.1) in freedesktop poppler. EPSS 0.3% chance of exploitation in the next 30 days.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-125
Published: 2025-04-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

freedesktop:poppler

References

https://gitlab.freedesktop.org/poppler/poppler/-/issues/1577
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792
https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html

Check your stack JSON