CVE-2008-2950: Poppler

High severity, CVSS 7.5. EPSS: 15% chance of exploitation in the next 30 days.

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Affected products

• Poppler Poppler: up to and including 0.8.4

Published 2008-07-07. Last modified 2026-06-16.