CVE Catalog
CVE-2025-32365
MediumSummary
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc due to a misplaced isOk check.
Risk Assessment
An attacker could exploit this to read out-of-bounds memory, potentially leading to information disclosure or crashes.
Recommendation
Update Poppler to version 25.04.0 or later which includes the corrected isOk check.
Original NVD description (English source)
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.