VulnerabilityDeferred

CVE-2026-44348

From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp.

LOW 2.5EPSS 0.10%

Does this matter?

Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.

Description

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.

CVSS 3.1: 2.5 LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS: 0.10% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-415
Source: security-advisories@github.com

References

https://github.com/podofo/podofo/commit/696d765c3a71ef224d4abffe1f174fef11292d7e
https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72
https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.