poppler uses std::atomic_int for reference counting. Because it is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. References:

Source: Mageia: Poppler Important Use-After-Free Issue MGASA-2025-0214