Poppler
Vendor:
First CVE: Jul 30, 2007 · Active for 18 years
89
Total CVEs
More Total CVEs than 99% of tracked products
6.4
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 40% of tracked products
1.1%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Poppler over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 30, 2007
18 years ago
Most Recent CVE
Oct 1, 2025
300 days ago
CVE Severity & Scoring
Poppler89 CVEs
56%
39%
All CVEs353,173 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local26 (29.2%)
Network53 (59.6%)
Unknown10 (11.2%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low77 (86.5%)
High2 (2.2%)
Unknown10 (11.2%)
User Interaction
None14 (15.7%)
Unknown10 (11.2%)
Required65 (73.0%)
Privileges Required
Low2 (2.2%)
High0 (0.0%)
None77 (86.5%)
Unknown10 (11.2%)
Top CVEs
Signals from CVEs in this product scope (89 CVEs).
89 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-30860HIGH An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7. | Aug 24, 2021 | 7.8 | 91 | YES | NO |
CVE-2019-9631CRITICAL Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. | Mar 8, 2019 | 9.8 | 31 | NO | NO |
CVE-2017-2820HIGH An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an int | Jul 12, 2017 | 8.8 | 30 | NO | NO |
CVE-2019-9200HIGH A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfi | Feb 26, 2019 | 8.8 | 29 | NO | NO |
CVE-2018-21009HIGH Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. | Sep 5, 2019 | 8.8 | 28 | NO | NO |
CVE-2019-12293HIGH In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. | May 23, 2019 | 8.8 | 28 | NO | NO |
CVE-2019-10872HIGH An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. | Apr 5, 2019 | 8.8 | 28 | NO | NO |
CVE-2017-1000456HIGH freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations. | Jan 2, 2018 | 8.8 | 28 | NO | NO |
CVE-2017-2818HIGH An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color compo | Jul 12, 2017 | 8.8 | 28 | NO | NO |
CVE-2017-2814HIGH An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizing after allocation ha | Jul 12, 2017 | 8.8 | 28 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (89 CVEs).
CISA KEV
1 CVE
1.1% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
1.1% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (89 CVEs).
Media Mentions
Signals from CVEs in this product scope (89 CVEs).
Top CNAs Publishing CVEs For Poppler
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 22.08.0 | 1 | 6.5 | 0.9% | 0 | 0 |
| 22.07.0 | 3 | 6.5 | 0.9% | 0 | 0 |
| 22.03.0 | 1 | 6.5 | 1.6% | 0 | 0 |
| 20.12.1 | 3 | 6.6 | 0.8% | 0 | 0 |
| 0.9.3 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.9.2 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.9.1 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.9.0 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.89.0 | 1 | 7.5 | 0.9% | 0 | 0 |
| 0.8.7 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.6 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.5 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.4 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.3 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.2 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.1 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.8.0 | 2 | 6.3 | 8.8% | 0 | 1 |
| 0.75.0 | 2 | 6.5 | 1.2% | 0 | 0 |
| 0.74.0 | 8 | 8.1 | 2.8% | 0 | 0 |
| 0.73.0 | 1 | 7.8 | 2.2% | 0 | 0 |