CVE-2026-44348
Low · 2.5CVSS
2.5
EPSS
0.1%
Published
May 14, 2026
CISA due date
—
The record
PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | podofo | 0 | 1.1.0-1.1 |
Related vulnerabilities
- CVE-2017-5886 Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in… Also affects podofo
- CVE-2026-109271 ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the… CWE-415
- CVE-2026-107886 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. CWE-415
- CVE-2026-107209 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-415
- CVE-2026-98154 In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO… CWE-415
- CVE-2026-87585 Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a… CWE-415
- CVE-2026-79907 Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary… CWE-415
- CVE-2026-82325 A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through… CWE-415