Heap Out-of-Bounds Read Vulnerability in PoDoFo PDF Library
CVE-2026-54633

6.9MEDIUM

Key Information:

Vendor

Podofo

Status
Podofo
Vendor
CVE Published:
17 September 2026

What is CVE-2026-54633?

The PoDoFo library, a C++17 PDF manipulation tool, is susceptible to a vulnerability that arises during the processing of specially crafted PDFs containing Indexed color-space images. This flaw can trigger a heap out-of-bounds read in the function PdfColorSpaceFilterIndexed::FetchScanLine, allowing access to adjacent heap data or potentially causing the processing application to crash. This occurs due to inadequate runtime checks on pixel index values, which can exceed the defined limits. Additionally, the validation of the high-value index in the PdfColorSpaceFilterFactory::TryCreateFromObject method does not incorporate the necessary upper bounds, further exposing the application to this security risk. The issue has been resolved in version 1.1.1 of the library.

Affected Version(s)

podofo >= 1.0.0, < 1.1.1

References

https://github.com/podofo/podofo/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/podofo/podofo/commit/999c519d285c4a65e...
x_refsource_MISC
https://github.com/podofo/podofo/releases/tag/1.1.1
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.