Use-After-Free Vulnerability in Poppler PDF Library

CVE-2025-52885

What is CVE-2025-52885?

A use-after-free vulnerability has been discovered in the Poppler PDF rendering library prior to version 25.10.0, specifically within the StructTreeRoot class. The flaw stems from the improper use of raw pointers pointing to elements within a std::vector, which can lead to dangling pointers upon vector resizing. Since std::vector internally manages its elements in dynamically allocated arrays, resizing can invalidate these pointers, posing significant security risks when these elements are accessed after the vector has been altered. The vulnerability can result in unpredictable behavior and potential exploitation. Version 25.10.0 includes critical fixes to address this issue.

References