DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects.
It looks like this flaw was introduced in Poppler 21.01.0 via commit  and fixed in the same release via commit ae614bf8ab (see previous comment).
The versions of `poppler` as shipped with Red Hat Enterprise Linux are not affected by this flaw, as the vulnerable code was introduced in a newer version of the package.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):