JLSEC-2026-90

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-90.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-90.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-90

Upstream

CVE-2025-52886

EUVD-2025-19742

Published

2026-04-13T13:20:05.063Z

Modified

2026-04-13T13:30:23.317336Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

[none]

Details

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52886",
            "id": "CVE-2025-52886",
            "modified": "2025-11-04T22:16:20.887Z",
            "imported": "2026-04-13T04:14:33.309Z",
            "published": "2025-07-02T16:15:28.933Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-52886"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19742",
            "id": "EUVD-2025-19742",
            "modified": "2025-11-04T22:06:42Z",
            "imported": "2026-04-13T04:14:34.608Z",
            "published": "2025-07-02T15:46:49Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-19742"
        }
    ]
}

References

Affected packages

Julia / Poppler_jll

Package

Name: Poppler_jll
Purl: pkg:julia/Poppler_jll?uuid=9c32591e-4766-534b-9725-b71a8799265b

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.10.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-90.json"