CVE-2025-50422

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-50422
Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.
CVSS

No CVSS.

References
Link Resource
https://github.com/Landw-hub/CVE-2025-50422
https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591#note_3045081
Configurations

No configuration.

History

10 Aug 2025, 02:15

Type Values Removed Values Added
References
  • {'url': 'http://poppler.com', 'name': 'http://poppler.com', 'tags': [], 'refsource': ''}
  • {'url': 'http://freedesktop.com', 'name': 'http://freedesktop.com', 'tags': [], 'refsource': ''}
  • () https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621 -
  • () https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591#note_3045081 -
  • () https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591 -
Summary An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream objects is not cleared upon program exit, allowing attackers to obtain sensitive PDF content via a memory dump. Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.
CWE CWE-617

04 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-04 17:15

Updated : 2025-08-10 02:15

NVD link : CVE-2025-50422

Mitre link : CVE-2025-50422

JSON object : View

Products Affected

No product.

CWE
CWE-617

Reachable Assertion