CVE-2025-52885

Name of the Vulnerable Software and Affected Versions Poppler versions prior to 25.10.0

Description Poppler is a library used for rendering PDF files and modifying their structure. A use-after-free (write) issue exists due to the use of raw pointers to elements within a std::vector in the StructTreeRoot class. This can result in dangling pointers when the vector is resized. The vulnerability originates from how refToParentMap stores references to std::vector elements using raw pointers, which become invalid upon vector resizing. A std::vector reallocates memory and moves elements when it reaches capacity, invalidating any previously stored raw pointers to those elements.

Recommendations Update to Poppler version 25.10.0 or later.