CVE-2019-9903: Medium severity Freedesktop poppler vulnerability
Last updated 25 August 2025
Other sources
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-9903?
CVE-2019-9903 is a vulnerability that affects Poppler 0.74.0, allowing for stack consumption due to mishandling of dict marking in the PDFDoc::markObject function.
Which software versions are affected by CVE-2019-9903?
Poppler 0.74.0, Fedora 28, Fedora 29, Fedora 30, Debian Linux 10.0, Ubuntu Linux 16.04, Ubuntu Linux 18.04, Ubuntu Linux 18.10, Ubuntu Linux 19.04, and Redhat Enterprise Linux 8.0-8.6 are affected by CVE-2019-9903.
What is the severity of CVE-2019-9903?
CVE-2019-9903 has a severity value of 6.5, which is considered medium.
How can I fix CVE-2019-9903?
To fix CVE-2019-9903, update Poppler to version 0.71.0-5+deb10u3 or higher (for Debian), version 20.09.0-3.1+deb11u1 or higher (for Ubuntu), or version 22.12.0-2 or higher (for general source).
Where can I find more information about CVE-2019-9903?
You can find more information about CVE-2019-9903 at the following references: [CVE-2019-9903](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9903), [Loginsoft Research Report](https://research.loginsoft.com/bugs/stack-based-buffer-overflows-in-dictfind-poppler-0-74-0/), [USN-4042-1](https://ubuntu.com/security/notices/USN-4042-1).