Executive brief
PoDoFo is a C++ library used to create and manipulate PDF documents. A flaw in how it processes PDF files with Indexed color-space images can allow an attacker to read adjacent memory or crash the application. This could expose sensitive data stored in memory or disrupt systems that rely on PoDoFo for PDF processing.
Technical details
The vulnerability is a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine, occurring when processing a crafted PDF with an Indexed color-space image. The root cause is that PODOFO_INVARIANT does not perform a runtime check on pixel indices, allowing values greater than or equal to m_MapSize to access memory beyond the m_lookup buffer. Additionally, PdfColorSpaceFilterFactory::TryCreateFromObject validates the hival parameter using incorrect logic with no upper bound checking, permitting malformed metadata. The attack vector is a crafted PDF file that must be processed by the application (no special authentication required). An attacker can disclose adjacent heap memory contents or trigger a crash. This issue is fixed in version 1.1.1.
Affected products
- PoDoFo PoDoFo 1.0.0 to 1.1.0
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched: Fixed in version 1.1.1