CVE-2025-32364
📋 TL;DR
A floating-point exception vulnerability in Poppler's PSStack::roll function allows attackers to cause denial of service by crashing applications that process malicious PDF files. This affects any application using Poppler for PDF rendering before version 25.04.0. The vulnerability is triggered by malformed inputs associated with INT_MIN values.
💻 Affected Systems
- Poppler PDF rendering library
- Applications using Poppler (e.g., Evince, Okular, PDF viewers)
📦 What is this software?
Poppler by Freedesktop
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service for PDF processing functionality, potentially disrupting document workflows or services that rely on Poppler.
Likely Case
Application crash when processing specially crafted PDF files, requiring restart of the affected application.
If Mitigated
No impact if patched version is used or if input validation prevents malformed PDFs from reaching vulnerable code.
🎯 Exploit Status
Exploitation requires sending a malicious PDF file to trigger the floating-point exception. No authentication is needed if the application processes PDFs from untrusted sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.04.0
Vendor Advisory: https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3
Restart Required: Yes
Instructions:
1. Update Poppler to version 25.04.0 or later. 2. For Linux distributions: Use package manager (apt-get update && apt-get upgrade poppler-utils, yum update poppler, etc.). 3. Recompile applications if using Poppler as a library. 4. Restart affected applications/services.
🔧 Temporary Workarounds
Input validation for PDF files
allImplement server-side validation to reject malformed PDF files before they reach Poppler processing.
Sandbox PDF processing
linuxRun PDF processing in isolated containers or sandboxes to limit impact of crashes.
🧯 If You Can't Patch
- Implement strict file upload restrictions to block potentially malicious PDFs
- Monitor application logs for crash events related to PDF processing
🔍 How to Verify
Check if Vulnerable:
Check Poppler version: poppler-utils --version or check library version in applications.Check Version:
poppler-utils --version 2>/dev/null || echo "Check application dependencies for Poppler version"Verify Fix Applied:
Confirm Poppler version is 25.04.0 or later and test with known safe PDF files.📡 Detection & Monitoring
Log Indicators:
- Application crashes with floating-point exception errors
- Segmentation faults in PDF processing components
- Unexpected termination of PDF viewer applications
Network Indicators:
- Multiple PDF upload attempts followed by service disruption
SIEM Query:
source="application.logs" AND ("floating-point exception" OR "SIGFPE" OR "poppler crash")