CVE-2025-52886: 
NixOS vulnerability analysis and mitigation

CVE-2025-52886 is a use-after-free (UAF) vulnerability in Poppler, a widely used open-source PDF rendering library. The flaw stems from the use of std::atomic_int (a 32-bit integer) for reference counting, which can be overflowed to trigger a use-after-free memory corruption condition. All Poppler versions prior to 25.06.0 are affected. The vulnerability was reported on April 3, 2025, fixed on June 2, 2025, and publicly disclosed on July 1–2, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Security Lab, Red Hat).

The root cause is an integer overflow (CWE-190) in Poppler's reference counting mechanism, which uses std::atomic_int — a 32-bit type — in four header files: Annot.h, Array.h, Dict.h, and Stream.h (CWE-416: Use After Free; CWE-911: Improper Update of Reference Count). An attacker can craft a malicious PDF containing a compressed stream that decompresses to a large annotation array (size 0x1000000) referenced by 0x100 pages, causing the annotation's reference count to be incremented 0x100000000 times, wrapping it around to zero and triggering premature object deletion followed by use-after-free access. The proof-of-concept file is only 3.1 KB in size but requires approximately 12 hours of processing time to trigger the overflow, significantly limiting practical exploitability. The fix in version 25.06.0 limits the maximum number of annotations to prevent the overflow (GitHub Security Lab, oss-security).

Successful exploitation could lead to application crashes (denial of service) due to memory corruption, and theoretically could be leveraged for arbitrary code execution within the context of the process using Poppler. The vulnerability has a high availability impact with no direct confidentiality or integrity impact per the CVSS scoring. Because Poppler is embedded in numerous applications (PDF viewers, document converters, web services), the attack surface extends to any software that processes untrusted PDF files using an affected version (GitHub Security Lab, Red Hat).

A proof-of-concept exploit file is publicly available in the GitHub Security Lab repository and was referenced in the coordinated disclosure. However, the researcher who discovered the vulnerability (Kevin Backhouse) noted that triggering the integer overflow took approximately 12 hours in testing, making real-world exploitation impractical in most scenarios. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (0.000140), reflecting very low probability of exploitation in the near term (GitHub Security Lab, oss-security).

1. Craft malicious PDF: Create a specially crafted PDF file containing a compressed stream that decompresses to an annotation array of size 0x1000000, referenced by 0x100 pages — this causes the annotation object's reference count to be incremented 0x100000000 times total.
2. Trigger processing: Deliver the malicious PDF to a target system running a vulnerable Poppler-based application (e.g., pdftohtml, Evince, or a web-based PDF processor using Poppler < 25.06.0).
3. Wait for overflow: Allow the application to process the PDF; the reference count on the annotation object in Annot.h will increment until it wraps around to zero (requires approximately 12 hours of processing in testing).
4. Use-after-free triggered: Once the reference count wraps to zero, the annotation object is prematurely freed while still referenced, resulting in a use-after-free condition that can cause a crash or, theoretically, enable code execution.
5. Achieve impact: In a crash scenario, this results in denial of service. In a more advanced exploitation scenario, heap manipulation techniques could potentially be used to achieve code execution, though this has not been demonstrated in practice (GitHub Security Lab, oss-security).

• Process: Unexpected crash or hang of Poppler-based applications (e.g., pdftohtml, evince, okular, gs) after processing a PDF file; abnormally high CPU usage sustained over many hours during PDF processing.
• File System: Presence of a small (~3.1 KB) PDF file that triggers extended processing time disproportionate to its size; core dump files generated by Poppler-linked processes.
• Logs: Application crash logs or segmentation fault entries in system logs (/var/log/syslog, journalctl) referencing Poppler-linked binaries; error messages related to annotation or memory access violations during PDF rendering.

The primary remediation is to upgrade Poppler to version 25.06.0 or later, which fixes the issue by limiting the maximum number of annotations to prevent the reference count overflow. Downstream distributions including SUSE, Ubuntu (USN-7675-1, USN-7687-1), Mageia, and Oracle Solaris have released updated packages. As a temporary workaround where patching is not immediately possible, restrict processing of PDF files from untrusted sources, and consider enabling runtime memory protections such as ASLR and stack canaries. Auditing all software that embeds Poppler as a dependency is also recommended (GitHub Security Lab, Oracle).

Kevin Backhouse of the GitHub Security Lab, who discovered and reported the vulnerability, publicly noted on the oss-security mailing list that he did not initially report it to the list himself because he does not consider it realistically exploitable given the 12-hour processing time required to trigger the overflow. Alan Coopersmith of Oracle Solaris Engineering posted the advisory to oss-security, prompting broader community awareness. The vulnerability received coverage in Linux security news outlets and distribution security advisories (SUSE, Ubuntu, Mageia), reflecting standard community response for a medium-severity library vulnerability (oss-security, oss-security).