CVE-2025-50420: Freedesktop Poppler DoS Vulnerability

CVE-2025-50420 Overview

CVE-2025-50420 is a denial-of-service vulnerability in the pdfseparate utility of Freedesktop Poppler version 25.04.0. The flaw allows attackers to trigger uncontrolled recursion by supplying a crafted PDF file. Poppler is a widely used PDF rendering library that ships with many Linux distributions and integrates with document viewers, thumbnailers, and print pipelines. Successful exploitation exhausts stack resources and terminates the process, disrupting document processing workflows. The issue is tracked under CWE-674: Uncontrolled Recursion.

Critical Impact
A single crafted PDF processed by pdfseparate causes infinite recursion, exhausting stack memory and resulting in a denial-of-service condition against document processing services.

Affected Products

Freedesktop Poppler v25.04.0
pdfseparate command-line utility bundled with Poppler
Downstream applications and services that invoke pdfseparate on untrusted PDFs

Discovery Timeline

2025-08-04 - CVE-2025-50420 published to NVD
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2025-50420

Vulnerability Analysis

The pdfseparate utility extracts single pages from PDF documents into standalone files. When parsing a crafted PDF, the utility enters an uncontrolled recursive call chain that never reaches a terminating condition. Each recursive frame consumes stack space until the process exhausts its stack allocation and aborts.

Because the vulnerability requires only a malformed input file, any automated pipeline that feeds attacker-controlled PDFs into pdfseparate is exposed. This includes mail gateways, document conversion services, print servers, and PDF splitting workflows in web applications. The impact is limited to availability. Confidentiality and integrity are not affected, and no code execution has been demonstrated.

Root Cause

The root cause is missing recursion depth enforcement during PDF object traversal in the pdfseparate code path. When object references in the PDF form a circular graph or a deeply nested structure, the parser follows them without bounding the call depth. This maps to CWE-674: Uncontrolled Recursion.

Attack Vector

An attacker delivers a specially crafted PDF to a system that invokes pdfseparate. Delivery can occur through email attachments, file uploads, or shared storage. User interaction is required to trigger processing. Once the file is processed, the pdfseparate process consumes stack memory until it crashes. A proof-of-concept file is available in the public PoC repository.

Detection Methods for CVE-2025-50420

Indicators of Compromise

Repeated crashes or abnormal terminations of pdfseparate processes on document processing hosts
Kernel or systemd logs showing segmentation faults or stack overflow signals for Poppler utilities
Sudden spikes in stack memory usage by short-lived pdfseparate invocations
Inbound PDF files that fail to open in reference viewers but target Poppler-based tooling

Detection Strategies

Monitor process exit codes and core dumps generated by pdfseparate and other Poppler utilities such as pdftoppm and pdftocairo
Alert on repeated failures of the same PDF asset across multiple processing jobs
Inspect PDFs for deeply nested or self-referential object graphs before handing them to Poppler

Monitoring Recommendations

Track resource consumption and crash counts for services that wrap pdfseparate in a sandbox or worker
Correlate crashes with the source IP or user account that submitted the offending file
Retain crashed sample files for offline analysis rather than discarding them silently

How to Mitigate CVE-2025-50420

Immediate Actions Required

Upgrade Poppler to a version later than 25.04.0 that includes the recursion depth fix once released by the Poppler project
Restrict pdfseparate execution to sandboxed workers with strict CPU, memory, and stack limits
Reject or quarantine PDFs from untrusted sources before invoking Poppler utilities

Patch Information

No vendor advisory URL is listed in the NVD entry at the time of writing. Administrators should track the Poppler upstream repository and their Linux distribution's security channels for a fixed release. Rebuild or repackage any downstream tools that statically link Poppler once a patched version is available.

Workarounds

Replace pdfseparate with an alternative page extraction tool such as qpdf for untrusted input
Apply a ulimit -s stack size cap and a wall-clock timeout to each pdfseparate invocation
Run PDF processing inside containers or seccomp-restricted processes so that a crash does not degrade the host
Pre-validate PDFs with a lightweight parser to reject files exceeding a safe object nesting threshold

bash

# Configuration example: constrain pdfseparate execution
ulimit -s 8192          # cap stack size at 8 MB
timeout 10s pdfseparate -f 1 -l 1 input.pdf page-%d.pdf