Heap Use-After-Free Vulnerability in PoDoFo Product by Podofo
CVE-2023-31566

8.8HIGH

Key Information:

Vendor

Podofo Project

Status
Podofo
Vendor
CVE Published:
10 May 2023

What is CVE-2023-31566?

The PoDoFo library version 0.10.0 is susceptible to a heap use-after-free flaw originating from the function PoDoFo::PdfEncrypt::IsMetadataEncrypted(). This vulnerability may lead to potential exploitation, allowing attackers to manipulate memory, which can result in arbitrary code execution or other unintended behavior. Users and developers are advised to review the library's usage and consider upgrades or patches to mitigate the risk associated with this vulnerability.

References

https://github.com/podofo/podofo/issues/70

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.