CVE-2025-11896: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-11896 is an uncontrolled recursion vulnerability in Xpdf 4.05 and earlier versions that causes infinite recursion and a stack overflow when processing a maliciously crafted PDF file. The flaw is triggered by a PDF object loop in a CMap structure via the UseCMap entry. It was disclosed on October 16, 2025, by Glyph & Cog, LLC (the Xpdf maintainer). The vulnerability carries a CVSS v4.0 base score of 2.1 (Low), assigned by the CNA (NVD, ENISA EUVD).

The root cause is classified as CWE-674 (Uncontrolled Recursion). When Xpdf processes a PDF file containing a CMap object that references itself or another CMap in a circular chain via the UseCMap entry, the parser enters infinite recursion with no depth limit or cycle detection, ultimately exhausting the call stack and causing a stack overflow crash. Exploitation requires a locally accessible or user-opened malicious PDF file, and the attack complexity is rated High due to the specific crafting required. The vendor's advisory references the object-loops security bug class (Xpdf Advisory).

Successful exploitation results in a denial-of-service condition — specifically a crash of the Xpdf process due to stack overflow. There is no impact on confidentiality or integrity; only availability is affected, and only at the local process level. The vulnerability does not enable code execution, privilege escalation, or lateral movement based on current analysis (NVD, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-11896. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins have been released by Nessus (IDs: 271676, 277536, 277586, 279053, 279054, 282544) and Qualys (IDs: 760227, 760240, 760244), indicating scanner coverage for affected systems (NVD).

1. Craft a malicious PDF: Create a PDF file containing a CMap resource with a circular UseCMap reference — e.g., CMap A references CMap B via UseCMap, and CMap B references CMap A, forming an infinite loop.
2. Deliver the file: Provide the crafted PDF to a target user via email attachment, download link, or shared file system, relying on the user opening it with an Xpdf-based tool (e.g., xpdf, pdftotext, pdftops).
3. Trigger parsing: When the target opens the PDF, Xpdf's CMap parser follows the UseCMap chain recursively without cycle detection, causing unbounded stack growth.
4. Achieve denial of service: The process crashes with a stack overflow, disrupting any workflow dependent on Xpdf for PDF processing (Xpdf Advisory).

• Process: Xpdf-related processes (xpdf, pdftotext, pdftops, pdfinfo) terminating abnormally with a segmentation fault or stack overflow signal (SIGSEGV/SIGABRT).
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing crash reports for Xpdf processes; core dump files generated in the working directory or /var/crash/.
• File System: Presence of unexpected or suspicious PDF files with unusual CMap structures in user download directories or temporary folders.

Users should upgrade Xpdf to a version newer than 4.05 that includes a fix for PDF object loop handling in CMap parsing, as referenced in the vendor's security advisory. Downstream distributions including Slackware (SSA-2025-319-01), Fedora 42, SUSE Linux, and openSUSE have released updated packages for Xpdf and the related Poppler library that address this vulnerability. As a workaround, avoid opening untrusted PDF files with Xpdf 4.05 or earlier, or use an alternative PDF renderer (Xpdf Advisory, Slackware Advisory).

The vulnerability received routine coverage from Linux security news aggregators and distribution security teams, with advisories issued for Slackware, Fedora, SUSE, and openSUSE. No notable researcher commentary, social media discussion, or significant media coverage has been identified beyond standard patch announcements (Linux Security, openSUSE).