CVE-2026-44348

EUVD-2026-30337
PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
2.5 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 0.68%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
podofo_projectpodofo
1.0.0 ≤
𝑥
< 1.0.4
CNA
Debian logo
Debian Releases
Debian Product
Codename
libpodofo
bookworm
0.9.8+dfsg-3
fixed
forky
0.9.8+dfsg-3.4
fixed
sid
0.9.8+dfsg-3.4
fixed
trixie
0.9.8+dfsg-3.2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libpodofo
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/podofo/podofo/commit/696d765c3a71ef224d4abffe1f174fef11292d7e
https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72
https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72