Double-Free Vulnerability in PoDoFo PDF Manipulation Library
CVE-2026-44348

2.5LOW

Key Information:

Vendor

Podofo

Status
Podofo
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44348?

PoDoFo, a C++17 PDF manipulation library, contains a double-free vulnerability in the compute_hash_to_sign() function. This issue arises when the EVP_DigestFinal function fails after the buffer has been freed, resulting in an attempt to free the buffer again in the Error handler, leading to potential heap corruption. Users are advised to upgrade to version 1.0.4, where this vulnerability is resolved.

Affected Version(s)

podofo >= 1.0.0, < 1.0.4

References

https://github.com/podofo/podofo/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/podofo/podofo/commit/696d765c3a71ef224...
x_refsource_MISC

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.