Heap Use-After-Free Vulnerability in PoDoFo PDF Library
CVE-2025-46205

8.1HIGH

Key Information:

Vendor

PoDoFo

Status
PoDoFo PDF Library
Vendor
CVE Published:
1 October 2025

What is CVE-2025-46205?

A vulnerability has been identified in the PoDoFo PDF library, specifically within the PdfTokenizer::ReadDictionary function. This flaw results from a heap-use-after-free condition when processing certain crafted PDF files. Attackers can exploit this vulnerability to trigger a Denial of Service (DoS), leading to potential application crashes. Users of affected versions are advised to implement mitigation strategies and update to the latest versions to safeguard against such threats.

References

https://github.com/podofo/podofo
https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-...
https://github.com/ShadowByte1/CVE-Reports/issues/1

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.