CVE-2025-11896
Fixed in a distro release EPSS <1%CVSS 2.1
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow.
Products: xpdf
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | poppler | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | poppler | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | poppler | 0.79.0-150200.3.49.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler-qt5 | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler-qt6 | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | poppler | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | poppler-qt5 | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | poppler-qt6 | 24.03.0-150600.3.27.1 |
| SUSE Linux Enterprise Server 16.0 | poppler | 25.04.0-160000.4.1 |
| SUSE Linux Enterprise Server 16.0 | poppler-qt6 | 25.04.0-160000.4.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | poppler | 0.43.0-16.70.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | poppler-qt | 0.43.0-16.70.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | poppler | 25.04.0-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | poppler-qt6 | 25.04.0-160000.4.1 |
| Ubuntu 16.04 LTS | ipe | no fix |
| Ubuntu 16.04 LTS | xpdf | no fix |
| Ubuntu 18.04 LTS | ipe | no fix |
| Ubuntu 18.04 LTS | xpdf | no fix |
| Ubuntu 20.04 LTS | ipe | no fix |
| Ubuntu 22.04 LTS | ipe | no fix |
| Ubuntu 22.04 LTS | xpdf | no fix |
| Ubuntu 24.04 LTS | ipe | no fix |
| Ubuntu 24.04 LTS | xpdf | no fix |
| Ubuntu 25.10 | ipe | no fix |
| Ubuntu 25.10 | xpdf | no fix |
| Ubuntu 26.04 LTS | ipe | no fix |
| Ubuntu 26.04 LTS | xpdf | no fix |
| Ubuntu 26.10 | ipe | no fix |
| Ubuntu 26.10 | xpdf | no fix |
| openSUSE Leap 15.6 | poppler | 24.03.0-150600.3.27.1 |
| openSUSE Leap 15.6 | poppler-qt5 | 24.03.0-150600.3.27.1 |
| openSUSE Leap 15.6 | poppler-qt6 | 24.03.0-150600.3.27.1 |
| openSUSE Leap 16.0 | poppler | 25.04.0-160000.4.1 |
| openSUSE Leap 16.0 | poppler-qt5 | 25.04.0-160000.4.1 |
| openSUSE Leap 16.0 | poppler-qt6 | 25.04.0-160000.4.1 |
| openSUSE Tumbleweed | poppler | 25.09.1-4.1 |