CVE-2022-27337 — Improper Use of Validation Framework in Poppler

CWE-1173 — Improper Use of Validation Framework10 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 53.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Freedesktop PopplerDebian LinuxFedoraproject Fedora
Timeline
PublishedMay 5
Latest updateAug 6

Description

A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Debianfreedesktop/poppler< 20.09.0-3.1+deb11u1+3
▶Ubuntufreedesktop/poppler< 0.86.1-0ubuntu1.2+4
▶NVDfreedesktop/poppler22.03.0

Also affects: Debian Linux 10.0, 11.0, Fedora 36

🔴Vulnerability Details

5
OSV
poppler vulnerabilities↗2025-08-06
▶
OSV
poppler vulnerabilities↗2023-08-03
▶
GHSA
GHSA-c4v5-29v5-3282: A logic error in the Hints::Hints function of Poppler v22↗2022-05-06
▶
OSV
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22↗2022-05-05
▶
CVEList
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22↗2022-05-05
▶

📋Vendor Advisories

4
Ubuntu
poppler vulnerabilities↗2025-08-06
▶
Ubuntu
poppler vulnerabilities↗2023-08-03
▶
Red Hat
poppler: A logic error in the Hints::Hints function can cause denial of service↗2022-05-13
▶
Debian
CVE-2022-27337: poppler - A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers ...↗2022
▶
CVE-2022-27337 — Improper Use of Validation Framework | cvebase