1. Home
  2. CVE Database
  3. CVE-2025-43903
MEDIUM · 4.3

CVE-2025-43903

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

Vulnerability Description

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
FreedesktopPoppler< 25.04.0

Related Weaknesses (CWE)

CWE-347

References

FAQ

What is CVE-2025-43903?

CVE-2025-43903 is a vulnerability with a CVSS score of 4.3 (MEDIUM). NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

How severe is CVE-2025-43903?

CVE-2025-43903 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-43903?

Check the references section above for vendor advisories and patch information. Affected products include: Freedesktop Poppler.