CVE-2022-27337
published 2022-05-05CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
PriorityP425medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
1.55%
72.0th percentile
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | poppler | < poppler 22.08.0-2 (bookworm) | poppler 22.08.0-2 (bookworm) |
| fedoraproject | fedora | — | — |
| freedesktop | poppler | — | — |
| freedesktop | poppler | >= 0 < 20.09.0-3.1+deb11u1 | 20.09.0-3.1+deb11u1 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.2 | 0.86.1-0ubuntu1.2 |
| freedesktop | poppler | >= 0 < 22.02.0-2ubuntu0.2 | 22.02.0-2ubuntu0.2 |
| freedesktop | poppler | >= 0 < 0.41.0-0ubuntu1.16+esm7 | 0.41.0-0ubuntu1.16+esm7 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm7 | 0.62.0-2ubuntu2.14+esm7 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.7+esm1 | 0.86.1-0ubuntu1.7+esm1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
poppler vulnerabilities
osv·2025-08-06·CVSS 6.5
CVE-2022-27337 [MEDIUM] poppler vulnerabilities
poppler vulnerabilities
Jieyong Ma discovered that poppler incorrectly handled certain malformed
PDF files. A remote attacker could possibly use this issue to cause poppler
to crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2022-27337)
Kevin Backhouse discovered that poppler incorrectly handled documents with
a large number of annotations. If a user or automated system were tricked
into opening a specially crafted document, a remote attacker could use
this issue to cause poppler to consume resources, leading to a denial of
service, or possibly execute arbitrary code. (CVE-2025-52886)
OSV
poppler vulnerabilities
osv·2023-08-03·CVSS 6.5
CVE-2022-27337 [MEDIUM] poppler vulnerabilities
poppler vulnerabilities
Jieyong Ma discovered that poppler incorrectly handled certain malformed
PDF files. A remote attacker could possibly use this issue to cause poppler
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)
It was discovered that poppler incorrectly handled certain malformed PDF
files. A remote attacker could possibly use this issue to cause poppler to
crash, resulting in a denial of service. This issue only affected Ubuntu
22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)
GHSA
GHSA-c4v5-29v5-3282: A logic error in the Hints::Hints function of Poppler v22
ghsa_unreviewed·2022-05-06
CVE-2022-27337 [MEDIUM] GHSA-c4v5-29v5-3282: A logic error in the Hints::Hints function of Poppler v22
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
OSV
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22
osv·2022-05-05·CVSS 6.5
CVE-2022-27337 [MEDIUM] CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2025-08-06·CVSS 6.5
CVE-2025-52886 [MEDIUM] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: Several security issues were fixed in poppler.
Jieyong Ma discovered that poppler incorrectly handled certain malformed
PDF files. A remote attacker could possibly use this issue to cause poppler
to crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2022-27337)
Kevin Backhouse discovered that poppler incorrectly handled documents with
a large number of annotations. If a user or automated system were tricked
into opening a specially crafted document, a remote attacker could use
this issue to cause poppler to consume resources, leading to a denial of
service, or possibly execute arbitrary code. (CVE-2025-52886)
Instructions: In general, a standard system update will make all the necessary c
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2023-08-03·CVSS 6.5
CVE-2022-27337 [MEDIUM] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: poppler could be made to crash if it opened a specially crafted file.
Jieyong Ma discovered that poppler incorrectly handled certain malformed
PDF files. A remote attacker could possibly use this issue to cause poppler
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)
It was discovered that poppler incorrectly handled certain malformed PDF
files. A remote attacker could possibly use this issue to cause poppler to
crash, resulting in a denial of service. This issue only affected Ubuntu
22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
poppler: A logic error in the Hints::Hints function can cause denial of service
vendor_redhat·2022-05-13·CVSS 6.5
CVE-2022-27337 [MEDIUM] CWE-1173 poppler: A logic error in the Hints::Hints function can cause denial of service
poppler: A logic error in the Hints::Hints function can cause denial of service
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
A logic error was found in Popplers' Hints::Hints function in the Hints.cc file. This flaw allows an attacker to trick a user into opening a crafted PDf file into the pdftops utility, which causes the program to hang for a long time, leading to a denial of service.
Package: poppler (Red Hat Enterprise Linux 6) - Not affected
Package: poppler (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2022-27337: poppler - A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers ...
vendor_debian·2022·CVSS 6.5
CVE-2022-27337 [MEDIUM] CVE-2022-27337: poppler - A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers ...
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Scope: local
bookworm: resolved (fixed in 22.08.0-2)
bullseye: resolved (fixed in 20.09.0-3.1+deb11u1)
forky: resolved (fixed in 22.08.0-2)
sid: resolved (fixed in 22.08.0-2)
trixie: resolved (fixed in 22.08.0-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230#note_1372177https://lists.debian.org/debian-lts-announce/2022/09/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOTDUXJOKDYO4I7MKHLT5NBGTN5E7FHQ/https://www.debian.org/security/2022/dsa-5224https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230#note_1372177https://lists.debian.org/debian-lts-announce/2022/09/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOTDUXJOKDYO4I7MKHLT5NBGTN5E7FHQ/https://www.debian.org/security/2022/dsa-5224
2022-05-05
Published