CVE-2025-32365: 
NixOS vulnerability analysis and mitigation

Poppler before version 25.04.0 contains a vulnerability that allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc. The issue stems from a misplaced isOk check in the code. This vulnerability was assigned CVE-2025-32365 and was disclosed on April 5, 2025 (NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) in the JBIG2Bitmap::combine function. The issue occurs due to improper validation of boundaries before memory access operations. The vulnerability has been assigned a CVSS v3.1 base score of 4.0 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating local access is required and the primary impact is on availability (NVD, Gitlab Issue).

When exploited, the vulnerability can lead to a denial of service condition through application crashes caused by invalid memory reads. The issue can be triggered when processing specially crafted PDF files containing malformed JBIG2 images (Gitlab Issue).

The vulnerability can be triggered by processing a specially crafted PDF file through affected Poppler versions. A proof of concept exists that demonstrates the vulnerability using the pdftocairo utility, which causes a segmentation fault due to an invalid memory read (Gitlab Issue).

The vulnerability has been fixed in Poppler version 25.04.0 by moving the isOk check inside the JBIG2Bitmap::combine function. Users are advised to upgrade to this version or later to mitigate the vulnerability (Gitlab MR).