Buffer Overflow Vulnerability in PDFunite by Vendor Poppler
CVE-2018-25306

6.9MEDIUM

Key Information:

Vendor

Poppler-utils

Status
PDFunite
Vendor
CVE Published:
29 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25306?

PDFunite version 0.41.0 is susceptible to a buffer overflow vulnerability that may allow local attackers to crash the application when processing specially crafted PDF files during merge operations. The issue arises in the XRef::getEntry function within libpoppler, leading to a segmentation fault. By exploiting this vulnerability, an attacker can disrupt the normal functioning of the PDFunite utility, highlighting a significant security concern for users relying on this tool for PDF file management.

Affected Version(s)

PDFunite 0.41.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25306 - Proof of Concept

References

https://www.exploit-db.com/exploits/44490
exploit
https://launchpad.net/ubuntu/artful/+package/poppler-utils
product
https://launchpad.net/ubuntu/+source/poppler/0.57.0-2ubun...
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hamm3r.py
.