Vulnerabilities ›

CVE-2018-25306

Medium

CWE-120 — Weakness Type

                    Published: Apr 29, 2026                      ·  Modified: May 2, 2026                      ·  Source: NVD                

CVSS v3

6.2

🔗 NVD Official

📄 Description (English)

PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility.

🤖 AI Executive Summary

CVE-2018-25306 is a buffer overflow vulnerability in PDFunite 0.41.0 affecting the libpoppler library's XRef::getEntry function. Local attackers can crash the application by processing malformed PDF files, causing denial of service through segmentation faults. While no public exploit exists and no patch is available, the vulnerability poses a risk to organizations processing untrusted PDF documents.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 22, 2026 14:06

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations most at risk include: Government agencies (NCA, Ministry of Interior) processing citizen documents; Banking sector (SAMA-regulated institutions) handling PDF-based financial documents and reports; Healthcare providers (MOH facilities) managing patient records in PDF format; Energy sector (ARAMCO, SEC) processing technical documentation; Telecom operators (STC, Mobily) handling billing and contract documents. The vulnerability primarily affects document processing workflows and could disrupt critical administrative operations.

🏢 Affected Saudi Sectors

Government Banking Healthcare Energy Telecommunications Education

🎯 MITRE ATT&CK Techniques

T1499 - Endpoint Denial of Service T1203 - Exploitation for Client Execution T1190 - Exploit Public-Facing Application

⚖️ Saudi Risk Score (AI)

5.2

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Identify all systems running PDFunite 0.41.0 or earlier versions of libpoppler

2. Restrict local access to PDFunite utilities to trusted users only

3. Implement input validation to reject malformed PDF files before processing

4. Disable PDFunite functionality if not essential to operations



Compensating Controls:

1. Run PDFunite in isolated/sandboxed environments with resource limits

2. Implement file integrity checks and validate PDF structure before processing

3. Monitor for segmentation faults and application crashes in logs

4. Use alternative PDF processing tools with active security maintenance

5. Apply principle of least privilege to PDF processing services



Detection Rules:

1. Monitor for segmentation faults (SIGSEGV) in PDFunite processes

2. Alert on unexpected termination of pdfunite utility

3. Log all PDF file processing attempts with file hash validation

4. Track access to PDFunite binaries and configuration files

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع الأنظمة التي تقوم بتشغيل PDFunite 0.41.0 أو الإصدارات الأقدم من libpoppler

2. تقييد الوصول المحلي إلى أدوات PDFunite للمستخدمين الموثوقين فقط

3. تنفيذ التحقق من صحة المدخلات لرفض ملفات PDF المعيبة قبل المعالجة

4. تعطيل وظيفة PDFunite إذا لم تكن ضرورية للعمليات



الضوابط البديلة:

1. تشغيل PDFunite في بيئات معزولة/محصورة مع حدود الموارد

2. تنفيذ فحوصات سلامة الملفات والتحقق من هيكل PDF قبل المعالجة

3. مراقبة أخطاء التجزئة وأعطال التطبيقات في السجلات

4. استخدام أدوات معالجة PDF بديلة مع صيانة أمان نشطة

5. تطبيق مبدأ أقل امتياز على خدمات معالجة PDF



قواعد الكشف:

1. مراقبة أخطاء التجزئة (SIGSEGV) في عمليات PDFunite

2. التنبيه على الإنهاء غير المتوقع لأداة pdfunite

3. تسجيل جميع محاولات معالجة ملفات PDF مع التحقق من بصمة الملف

4. تتبع الوصول إلى ملفات وملفات تكوين PDFunite الثنائية

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.12.6.1 - Management of technical vulnerabilities ECC 2024 A.14.2.1 - Secure development policy ECC 2024 A.12.2.1 - Monitoring and logging of access

🔵 SAMA CSF

SAMA CSF ID.BE-5.1 - Organizational resilience management SAMA CSF PR.DS-6 - Data is protected from unauthorized access SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events

🟡 ISO 27001:2022

ISO 27001:2022 A.12.2.1 - Monitoring and logging ISO 27001:2022 A.14.2.1 - Secure development policy and procedures ISO 27001:2022 A.8.1.1 - Inventory of assets

🔗 References & Sources 4

🔗

https://launchpad.net/ubuntu/+source/poppler/0.57.0-2ubuntu4.2

disclosure@vulncheck.com

🔗

https://launchpad.net/ubuntu/artful/+package/poppler-utils

disclosure@vulncheck.com

🔗

https://www.exploit-db.com/exploits/44490

disclosure@vulncheck.com

🔗

https://www.vulncheck.com/advisories/pdfunite-buffer-overflow-via-malformed-pdf

disclosure@vulncheck.com

📊 CVSS Score

6.2

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityN — None / Network

AvailabilityH — High

📋 Quick Facts

Severity Medium

CVSS Score6.2

CWECWE-120

EPSS0.02%

Exploit No

Patch ✗ No

Published 2026-04-29

Source Feed nvd

🇸🇦 Saudi Risk Score

5.2

/ 10.0 — Saudi Risk

Priority: MEDIUM

🏷️ Tags

CWE-120

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2018-25306

Introduce Yourself

Sign In Required