CVE-2013-4474: Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 a...

Security readout for executives and security teams

Poppler’s pdfseparate utility before 0.24.3 could crash when given a destination filename containing format-string markers. The business impact is mainly availability: automated document-processing jobs that expose filename selection to users could be interrupted. The source bundle does not show active exploitation. Exposure is most likely where Poppler’s pdfseparate is installed and used in automated PDF workflows that accept or derive output filenames from untrusted input. Desktop-only installations with no untrusted filename handling have lower practical exposure. Treat this as a low-priority remediation unless Poppler pdfseparate is part of an exposed document-processing pipeline. For internet-facing or customer-upload workflows, patch during the next normal maintenance window and verify filename handling. Mitigation focus: Upgrade Poppler to 0.24.3 or a vendor-patched package.; Apply relevant distribution security updates from Ubuntu, Gentoo, Debian, or your platform vendor.; Restrict untrusted control over pdfseparate destination filenames..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.