PO
Product
poppler
On CISA KEVExploited in the wild
95
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 33Medium 48Low 3
Watch
Add poppler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20650 | 6.5 | Jan 1 | A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use… Affected: 0.72.0 |
| CVE-2018-20551 | 6.5 | Dec 28 | A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the… Affected: 0.72.0 |
| CVE-2018-20481 | 6.5 | Dec 26 | XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a… Affected: 0.72.0 |
| CVE-2018-19149 | 6.5 | Nov 10 | Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment Affected: before 0.70.0 |
| CVE-2018-19060 | 6.5 | Nov 7 | An issue was discovered in Poppler 0.71.0 Affected: 0.71.0 |
| CVE-2018-19059 | 6.5 | Nov 7 | An issue was discovered in Poppler 0.71.0 Affected: 0.71.0 |
| CVE-2018-19058 | 6.5 | Nov 7 | An issue was discovered in Poppler 0.71.0 Affected: 0.71.0 |
| CVE-2018-18897 | 6.5 | Nov 2 | An issue was discovered in Poppler 0.71.0 Affected: 0.71.0 |
| CVE-2018-16646 | 6.5 | Sep 6 | In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file Affected: 0.68.0 |
| CVE-2018-13988 | 6.5 | Jul 25 | Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite Affected: through 0.62.0 |
| CVE-2018-10768 | 6.5 | May 6 | There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5 Affected: before 0.41.0 |
| CVE-2017-9775 | 6.5 | Jun 22 | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document Affected: through 0.55.0 |
| CVE-2017-9408 | 6.5 | Jun 2 | In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file Affected: 0.54.0 |
| CVE-2017-9406 | 6.5 | Jun 2 | In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file Affected: 0.54.0 |
| CVE-2017-9083 | 6.5 | May 19 | poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc Affected: 0.54.0 |
| CVE-2026-93314 | 6.3 | Sep 18 | Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow Affected: 26.07.0 |
| CVE-2026-93313 | 6.3 | Sep 18 | Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow Affected: 26.07.0 |
| CVE-2025-52886 | 5.9 | Jul 2 | Poppler is a PDF rendering library Affected: before 25.06.0 |
| CVE-2025-32364 | 5.5 | Apr 5 | A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN Affected: before 25.04.0 |
| CVE-2020-36024 | 5.5 | Aug 11 | An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1… Affected: 20.12.1 |
| CVE-2023-34872 | 5.5 | Jul 31 | A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open Affected: before 23.06.0 |
| CVE-2017-18267 | 5.5 | May 10 | The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file,… Affected: through 0.64.0 |
| CVE-2017-14928 | 5.5 | Sep 30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document Affected: 0.59.0 |
| CVE-2017-14927 | 5.5 | Sep 30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document Affected: 0.59.0 |
| CVE-2017-14926 | 5.5 | Sep 30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document Affected: 0.59.0 |
| CVE-2017-14517 | 5.5 | Sep 17 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document Affected: 0.59.0 |
| CVE-2017-9865 | 5.5 | Jun 25 | The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash)… Affected: 0.54.0 |
| CVE-2017-7515 | 5.5 | Jun 6 | poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service Affected: through 0.55.0 |
| CVE-2017-7511 | 5.5 | May 30 | poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents Affected: 0.17.3; 0.17.4; 0.18.0; 0.18.1; 0.18.2; 0.18.3; +34 more |
| CVE-2026-93312 | 4.3 | Sep 18 | Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference Affected: 26.07.0 |
| CVE-2026-93311 | 4.3 | Sep 18 | Freedesktop Poppler SampledFunction Function.cc integer overflow Affected: 26.07.0 |
| CVE-2024-56378 | 4.3 | Dec 22 | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc Affected: through 24.12.0 |
| CVE-2026-102621 | 3.3 | Sep 29 | Freedesktop Poppler SplashClip.cc clipToPath integer overflow Affected: 26.08 |
| CVE-2026-102620 | 3.3 | Sep 29 | Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow Affected: 26.06.0; 26.07.0; 26.08.0 |
| CVE-2025-43903 | 3.3 | Apr 18 | NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries Affected: before 25.04.0 |
| CVE-2010-5110 | – | Aug 29 | DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file Affected: through 0.13.2; 0.13.0; 0.13.1 |
| CVE-2013-4472 | – | Apr 22 | The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a… Affected: through 0.24.3; 0.24.0; 0.24.1; 0.24.2 |
| CVE-2013-7296 | – | Jan 26 | The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string, which allows context-dependent attackers… Affected: through 0.24.3; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.10.0; +34 more |
| CVE-2013-4474 | – | Nov 23 | Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format… Affected: through 0.24.1; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2013-4473 | – | Nov 23 | Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly… Affected: through 0.24.1; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2013-1790 | – | Apr 9 | poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the… Affected: through 0.22.0 |
| CVE-2013-1789 | – | Apr 9 | splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1)… Affected: through 0.22.0 |
| CVE-2013-1788 | – | Apr 9 | poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory… Affected: through 0.22.0 |
| CVE-2010-3702 | – | Nov 5 | The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows… Affected: 0.8.7 through 0.15.1 |
| CVE-2007-3387 | – | Jul 30 | Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS,… Affected: before 0.5.91 |