Executive brief
PoDoFo is a software library used by developers to create and modify PDF files. A technical flaw in how the library handles digital signatures could allow a specially crafted PDF to crash an application using this library. While the risk of data theft is low, it could lead to service instability or application crashes when processing certain files.
Technical details
A double-free vulnerability (CWE-415) exists in the PoDoFo library within the `compute_hash_to_sign()` function located in `OpenSSLInternal_Ripped.cpp`. The root cause is a failure to nullify a pointer (`buf`) after an initial free following an `EVP_DigestUpdate` call. If a subsequent `EVP_DigestFinal` call fails, the execution jumps to an error label that attempts to free the same pointer a second time. This requires a local attacker to provide a crafted PDF that triggers a specific OpenSSL failure during the signing process. Successful exploitation results in heap corruption and a denial-of-service (crash), though the complexity is high as the error condition is difficult to trigger. The issue is resolved in version 1.0.4 by setting the pointer to null after the first free.
Affected products
- PoDoFo PoDoFo 1.0.0 to before 1.0.4
Timeline
- 2026-05-01: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fix included in version 1.0.4