Stack Consumption Vulnerability in Poppler PDF Library

CVE-2025-43718

What is CVE-2025-43718?

The Poppler PDF library versions 24.06.1 through 25.x prior to 25.04.0 are prone to a stack consumption vulnerability. This issue arises from handling deeply nested structures in PDF metadata, such as the GTS_PDFEVersion element. Exploiting this vulnerability can lead to a stack overflow, causing a segmentation fault (SIGSEGV) during operations within functions like Dict::lookup and Catalog::getMetadata. The flaw is exacerbated by the deep recursion needed in the regex executor, potentially leading to application crashes. Users and developers are advised to review and upgrade their Poppler installations to mitigate the risk.

References