Description
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.8.4-1.1 | — |
| Debian 13 | poppler | 0.8.4-1.1 | — |
| Debian 12 | poppler | 0.8.4-1.1 | — |
| Debian 5.0 | poppler | 0.8.2-2+lenny1 | DTSA-146-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 21.08.0-1.3 | openSUSE-SU-2024:11181-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution EDB-6032 · local · Jul 8, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- DTSA-146-1 poppler - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11181-1 libpoppler-cpp0-21.08.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://wiki.rpath.com/Advisories:rPSA-2008-0223
- 20080709 rPSA-2008-0223-1 poppler mailing-list
- 6032 exploit
- 30963 third-party-advisory
- SUSE-SR:2008:015 vendor-advisory
- ADV-2008-2024 vdb-entry
- 31002 third-party-advisory
- 30107 vdb-entry
- GLSA-200807-04 vendor-advisory
- http://www.ocert.org/advisories/ocert-2008-007.html
- 31267 third-party-advisory
- USN-631-1 vendor-advisory
- 31405 third-party-advisory
- FEDORA-2008-7104 vendor-advisory
- poppler-page-destructor-code-execution(43619) vdb-entry
- MDVSA-2008:146 vendor-advisory
- 3977 third-party-advisory
- 1020435 vdb-entry
- 20080707 [oCERT-2008-007] libpoppler uninitialized pointer mailing-list
- 31167 third-party-advisory