CVE-2025-43718: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-43718 is a stack consumption vulnerability (uncontrolled recursion) in the Poppler PDF rendering library, affecting versions 24.06.1 through 25.x before 25.04.0. The flaw resides in Poppler's metadata parsing logic, where deeply nested structures within PDF metadata fields (such as GTS_PDFEVersion) trigger unbounded recursion in the C++ regex executor (std::__detail::_Executor), leading to stack exhaustion and a SIGSEGV crash. It affects utilities including pdfinfo, pdffonts, and pdftohtml, as well as any application using the Poppler API. The CVE was published on October 1, 2025, and carries a CVSS v3.1 base score of 2.9 (Low) (Feedly, GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): Poppler's metadata parser lacks stack depth validation when evaluating deeply nested or malformed metadata structures in PDF documents. When a crafted PDF containing an excessively long or nested GTS_PDFEVersion field is processed, the functions Dict::lookup, Catalog::getMetadata, and PDFDoc::loadMetadata invoke the C++ standard library regex executor (std::__detail::_Executor::match), which recurses without bound until the call stack is exhausted. AddressSanitizer traces confirm the recursive call chain terminates in a stack-overflow signal. The attack vector is local (the victim or an automated process must open or parse the crafted PDF), and exploitation requires no privileges but does require user interaction or a server-side parsing trigger (GitHub Advisory, Feedly).

Successful exploitation causes a denial-of-service condition via stack exhaustion and SIGSEGV crash in any Poppler-based utility or application processing the malicious PDF. In memory-constrained environments, the researcher notes a theoretical potential for controlled stack overwrite leading to code execution, though this has not been demonstrated in practice. Applications and services that automatically process untrusted PDFs using Poppler (e.g., document conversion pipelines, email attachment scanners) are at elevated risk of crash propagation and service disruption (GitHub Advisory).

No public exploit code or weaponized exploit kit has been identified for CVE-2025-43718. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A minimal proof-of-concept concept (crafted PDF with a deeply nested GTS_PDFEVersion field) is described in the researcher's advisory but detailed PoC code was withheld pending full upstream patch validation (Feedly, GitHub Advisory).

1. Craft malicious PDF: Create a PDF document with a GTS_PDFEVersion metadata field containing an excessively long or deeply nested string, e.g., /GTS_PDFEVersion (PDF/X-3Gd((((((((((((((((((((((((((((((((((((((((((AAAAAAA...))))))))))))))))))))))))))))))))))))).
2. Deliver the PDF: Distribute the crafted PDF via email attachment, drive-by download, file upload to a document processing service, or direct file placement on a target system.
3. Trigger parsing: Cause the target to process the PDF using a vulnerable Poppler utility (e.g., pdfinfo crafted.pdf, pdffonts crafted.pdf, or pdftohtml crafted.pdf) or via an application that calls Poppler's API internally.
4. Observe crash: The metadata parser invokes Dict::lookup → Catalog::getMetadata → std::__detail::_Executor::match in an unbounded recursive loop, exhausting the call stack and producing a SIGSEGV crash (DoS condition) (GitHub Advisory).

• Process: Unexpected termination (SIGSEGV) of Poppler-based processes such as pdfinfo, pdffonts, pdftohtml, or any application embedding Poppler, particularly when processing externally sourced PDF files.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing segmentation fault entries for Poppler utilities; AddressSanitizer output containing stack-overflow in std::__detail::_Executor call frames if ASAN-instrumented builds are in use.
• File System: Presence of PDF files with unusually large or deeply nested GTS_PDFEVersion metadata fields in directories used by automated document processing pipelines.
• Core Dumps: Core dump files generated by crashed Poppler processes, with stack traces referencing Dict::lookup, Catalog::getMetadata, or std::__detail::_Executor::_M_handle_match (GitHub Advisory).

Upgrade Poppler to version 25.04.0 or later, which introduces proper recursion depth checks and improved input validation in the metadata parser. Linux distribution users should apply vendor-supplied security updates: Ubuntu (USN-7803-1), Fedora (mingw-poppler update), SUSE, and Debian have all issued patches (Tenable, Linux Security). As interim workarounds, avoid processing untrusted PDFs with vulnerable Poppler builds, apply ulimit -s stack size constraints for CLI utilities, and use sandboxed containers for automated PDF parsing workflows.

The vulnerability received coverage from Linux security news aggregators including LinuxSecurity.com and LinuxCompatible.org in the context of distribution security updates for Ubuntu, Fedora, SUSE, and Debian. Pro-Linux.de published multiple advisories noting the issue in mingw-poppler packages. No significant vendor statements beyond patch releases or notable researcher commentary beyond the original discoverer's advisory have been identified (Linux Security, Linux Compatible).