CVE-2025-43903

3.3 lowEPSS 0.1%

Low (3.3) in freedesktop poppler. EPSS 0.1% chance of exploitation in the next 30 days.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
CWE: CWE-347
Published: 2025-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

freedesktop:poppler

References

https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669

Check your stack JSON