CVE-2025-32365: Freedesktop Poppler OOB Read Vulnerability

CVE-2025-32365 Overview

CVE-2025-32365 is an out-of-bounds read vulnerability [CWE-125] in Poppler, the open-source PDF rendering library used by document viewers, file managers, and server-side conversion utilities across Linux distributions. Versions prior to 25.04.0 mishandle a misplaced isOk check inside the JBIG2Bitmap::combine function in JBIG2Stream.cc. A crafted PDF containing malformed JBIG2 image streams triggers the read past allocated memory when processed by an affected Poppler build. Successful exploitation can leak adjacent process memory or crash the consuming application, resulting in denial of service for document workflows.

Critical Impact
A specially crafted PDF can cause out-of-bounds memory reads in any application that links Poppler, leading to process crashes and potential disclosure of in-process memory.

Affected Products

Freedesktop Poppler versions prior to 25.04.0
Linux distributions packaging vulnerable Poppler builds, including Debian LTS
Downstream applications that embed Poppler for PDF rendering or conversion (for example Evince, Okular, pdftoppm, pdftotext)

Discovery Timeline

2025-04-05 - CVE-2025-32365 published to the National Vulnerability Database
2025-04 - Debian LTS security announcement released for affected Poppler packages
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-32365

Vulnerability Analysis

The defect resides in JBIG2Bitmap::combine within JBIG2Stream.cc, the module responsible for decoding JBIG2-compressed bitmap segments embedded in PDF documents. Poppler performs an isOk validation on bitmap state, but the check is placed after operations that already dereference attacker-controlled bitmap dimensions. When a PDF supplies inconsistent JBIG2 segment metadata, the combine routine reads outside the bounds of the source or destination bitmap buffer.

Because the read occurs during normal document parsing, no privileged context or user interaction beyond opening the file is required. The exploitation surface is local: a user, thumbnailer, or automated conversion pipeline must process the malicious PDF. The vulnerability does not directly grant code execution, but the disclosed memory can include heap metadata useful for chaining with separate flaws.

Root Cause

The root cause is an ordering error in input validation. The isOk sentinel that guards bitmap usability is consulted after pointer arithmetic and pixel-combine logic have already used unvalidated width and height fields from the JBIG2 stream. This violates the principle of validating untrusted input before consuming it, producing an out-of-bounds read [CWE-125].

Attack Vector

An attacker crafts a PDF containing a malformed JBIG2 image and delivers it through any channel that results in rendering. Common vectors include email attachments processed by desktop viewers, files dropped into directories indexed by tracker-extract or GNOME thumbnailers, and server-side pdftoppm or pdftotext jobs in document pipelines. Triggering only requires the victim or service to open or preview the document.

No public proof-of-concept exploit has been published at the time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical context is available in the GitLab Poppler Issue #1577 and the corresponding GitLab Poppler Merge Request #1792.

Detection Methods for CVE-2025-32365

Indicators of Compromise

Repeated crashes or SIGSEGV terminations of evince, okular, pdftoppm, pdftotext, pdftocairo, or other Poppler-linked binaries when handling user-supplied PDFs
dmesg or journalctl entries showing segmentation faults inside libpoppler.so with offsets resolving to JBIG2Stream symbols
AppArmor or SELinux audit denials generated by document thumbnailers processing untrusted attachments

Detection Strategies

Inventory installed Poppler packages across Linux endpoints and servers, flagging any version below 25.04.0
Scan inbound PDFs for JBIG2 segments with malformed bitmap dimensions using PDF parsers such as pdfid and peepdf
Correlate file-open events on PDFs with subsequent process crashes of Poppler-linked binaries within a short window

Monitoring Recommendations

Forward crash telemetry from systemd-coredump and abrt to a central log platform for hunting on Poppler-linked binaries
Enable application crash auditing in EDR tooling and alert on repeated faults in PDF processing utilities on file servers and mail gateways
Track package versions through configuration management to confirm timely deployment of the fixed Poppler release

How to Mitigate CVE-2025-32365

Immediate Actions Required

Upgrade Poppler to version 25.04.0 or later on all systems that render or convert PDFs
Apply distribution updates referenced in the Debian LTS Security Announcement and equivalent advisories from Red Hat, SUSE, and Ubuntu
Restart long-running services that link Poppler dynamically so the patched library is loaded into memory

Patch Information

The upstream fix reorders the isOk validation in JBIG2Bitmap::combine so bitmap state is verified before any pixel data is accessed. It is merged in Poppler Merge Request #1792 and included in release 25.04.0. Distribution maintainers have backported the patch to supported LTS branches; consult the vendor advisory for your platform for the exact package version.

Workarounds

Disable automatic PDF thumbnailing and preview generation in file managers until patched packages are deployed
Process untrusted PDFs inside sandboxed environments such as bubblewrap, firejail, or containerized converters with read-only mounts
Restrict server-side PDF conversion services to authenticated submissions and enforce per-process resource limits to contain crashes

bash

# Verify the installed Poppler version on Debian and Ubuntu hosts
dpkg -l | grep -E 'poppler|libpoppler'

# Upgrade to the patched package set
sudo apt-get update
sudo apt-get install --only-upgrade libpoppler-glib8 libpoppler-cpp0v5 poppler-utils

# Confirm the runtime library version after upgrade
pdftoppm -v 2>&1 | head -n 1