CVE-2025-52885

A use-after-free vulnerability has been identified in Poppler’s StructTreeRoot class when processing specially crafted PDF documents. An attacker could exploit this flaw by persuading a user to open a malicious PDF file, or by placing such a file on a share that is later previewed, causing the application to reference freed memory. This can lead to unexpected behavior in the context of the application handling the PDF.

This flaw has been rated Moderate impact by Red Hat Product Security. Exploitation requires a local user to open a maliciously crafted PDF file. Successful attacks could majorly lead to the application to crash. Because user interaction and local access are required, the likelihood of exploitation in typical environments is considered Moderate to Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond the update recommendation.