CVE Catalog
CVE-2025-43903
MediumSummary
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.
Risk Assessment
An attacker could forge digital signatures in PDF documents, leading to fraud or integrity breaches.
Recommendation
Update Poppler to version 25.04.0 or later which implements proper signature verification.
Original NVD description (English source)
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.