LiveActive security incident?Get immediate response
CVE Record

CVE-2018-19059: An issue was discovered in Poppler 0.71.0.

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2018-19059 is a Poppler PDF-processing flaw that can crash affected processing when handling malformed embedded files. The described impact is denial of service, not data theft or remote code execution. Business risk is highest where automated services process untrusted PDFs at scale.

Executive priority

Treat this as a practical availability risk for document-processing systems. Prioritize patching where untrusted PDFs are processed automatically or where crashes would interrupt customer-facing workflows. It is lower urgency for isolated desktops with limited PDF handling exposure.

Technical view

Poppler 0.71.0 has an out-of-bounds read in EmbFile::save2 in FileSpec.cc. The CVE says utils/pdfdetach.cc did not validate embedded files before save attempts, causing denial of service. The source bundle does not provide CVSS, CWE, CPE, or complete affected-version ranges.

Likely exposure

Exposure is likely on systems using Poppler or distribution Poppler packages to inspect, render, or detach embedded files from PDFs. Internet-facing upload portals, document pipelines, and mail or case-management workflows processing untrusted PDFs are the most relevant environments.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The described trigger is processing a crafted PDF with embedded file handling, leading to a crash or service disruption. No exploit steps are provided here.

Researcher notes

The strongest source detail is the CVE description: Poppler 0.71.0, EmbFile::save2, FileSpec.cc, and pdfdetach validation failure. Affected product metadata is incomplete in the bundle, with no CPEs, CVSS, or CWE. Avoid expanding scope beyond Poppler and vendor-packaged Poppler updates.

Mitigation direction

  • Apply Poppler updates from the relevant OS or vendor advisory.
  • Review Ubuntu USN-3837-1 and Red Hat RHSA-2019:2022 for package-specific guidance.
  • Limit automated processing of untrusted PDFs where Poppler cannot be updated quickly.
  • Add crash monitoring around PDF extraction or embedded-file handling services.
  • Run PDF processing with least privilege and resource isolation.

Validation and detection

  • Inventory hosts and containers with Poppler or pdfdetach installed.
  • Compare installed packages against Ubuntu or Red Hat advisory-fixed versions.
  • Identify workflows that process untrusted PDFs or detach embedded files.
  • Review service logs for Poppler, pdfdetach, or PDF-worker crashes.
  • Confirm scanners map this finding specifically to CVE-2018-19059.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-19059 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.