CVE-2025-46205 | High | 8.1 | 2025-10-01 | A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplyin… |
CVE-2025-9394 | Medium | 5.3 | 2025-08-24 | A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the… |
CVE-2023-31568 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4. |
CVE-2023-31567 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3. |
CVE-2023-31566 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted(). |
CVE-2023-31556 | Medium | 6.5 | 2023-05-10 | podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent. |
CVE-2023-31555 | Medium | 6.5 | 2023-05-10 | podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad. |
CVE-2023-2241 | Medium | 5.3 | 2023-04-22 | A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObje… |
CVE-2020-18972 | Medium | 5.5 | 2021-08-25 | Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component… |
CVE-2020-18971 | Medium | 5.5 | 2021-08-25 | Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'. |
CVE-2021-30472 | High | 7.8 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. A stack-based buffer overflow in PdfEncryptMD5Base::ComputeOwnerKey function in PdfEncrypt.cpp is possible because of a impro… |
CVE-2021-30471 | Medium | 5.5 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a sta… |
CVE-2021-30470 | Medium | 5.5 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType… |
CVE-2021-30469 | Medium | 5.5 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of service via a crafted PDF file. |
CVE-2019-20093 | Medium | 5.5 | 2019-12-30 | The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) vi… |
CVE-2019-10723 | Medium | 5.5 | 2019-04-03 | An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitial… |
CVE-2019-9687 | Critical | 9.8 | 2019-03-11 | PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. |
CVE-2018-20797 | Medium | 6.5 | 2019-02-27 | An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called… |
CVE-2019-9199 | High | 8.8 | 2019-02-26 | PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a… |
CVE-2018-20751 | High | 8.8 | 2019-02-04 | An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be pr… |
CVE-2018-19532 | High | 8.8 | 2018-11-26 | A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject… |
CVE-2018-14320 | Medium | 6.5 | 2018-09-17 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit thi… |
CVE-2018-12983 | High | 7.8 | 2018-06-29 | A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote att… |
CVE-2018-12982 | Medium | 5.5 | 2018-06-29 | Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service imp… |
CVE-2018-11256 | Medium | 6.5 | 2018-05-18 | An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of ser… |
CVE-2018-11255 | Medium | 5.5 | 2018-05-18 | An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of serv… |
CVE-2018-11254 | Medium | 5.5 | 2018-05-18 | An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers coul… |
CVE-2018-8002 | High | 8.8 | 2018-03-09 | In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.cpp which may result in stack overflow… |
CVE-2018-8001 | High | 7.8 | 2018-03-09 | In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp. Remote attackers could leverage this vulnerability… |
CVE-2018-8000 | High | 8.8 | 2018-03-09 | In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-20… |
CVE-2018-6352 | Medium | 5.5 | 2018-01-27 | In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers could leverage this vul… |
CVE-2018-5783 | Medium | 5.5 | 2018-01-19 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could lever… |
CVE-2018-5309 | Medium | 5.5 | 2018-01-09 | In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote… |
CVE-2018-5308 | High | 7.8 | 2018-01-09 | PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could levera… |
CVE-2018-5296 | Medium | 5.5 | 2018-01-08 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage… |
CVE-2018-5295 | Medium | 5.5 | 2018-01-08 | In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers cou… |
CVE-2017-8787 | High | 8.8 | 2017-05-05 | The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause… |
CVE-2017-8378 | Critical | 9.8 | 2017-05-01 | Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (a… |
CVE-2017-8054 | Medium | 5.5 | 2017-04-22 | The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion… |
CVE-2017-8053 | Medium | 5.5 | 2017-04-22 | PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser… |
CVE-2017-7994 | Medium | 6.5 | 2017-04-21 | The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-7383 | Medium | 5.5 | 2017-04-03 | The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a… |
CVE-2017-7382 | Medium | 5.5 | 2017-04-03 | The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a… |
CVE-2017-7381 | Medium | 5.5 | 2017-04-03 | The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a cra… |
CVE-2017-7380 | Medium | 5.5 | 2017-04-03 | The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a cra… |
CVE-2017-7379 | Medium | 5.5 | 2017-04-03 | The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based b… |
CVE-2017-7378 | Medium | 5.5 | 2017-04-03 | The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read… |
CVE-2015-8981 | Critical | 9.8 | 2017-03-16 | Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vector… |
CVE-2017-6849 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-6848 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) v… |
CVE-2017-6847 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) vi… |
CVE-2017-6846 | Medium | 5.5 | 2017-03-15 | The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of ser… |
CVE-2017-6845 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a c… |
CVE-2017-6844 | High | 7.8 | 2017-03-15 | Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a… |
CVE-2017-6843 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact v… |
CVE-2017-6842 | Medium | 5.5 | 2017-03-15 | The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-6841 | Medium | 5.5 | 2017-03-15 | The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of servi… |
CVE-2017-6840 | Medium | 5.5 | 2017-03-15 | The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a craf… |
CVE-2017-5886 | High | 7.8 | 2017-03-01 | Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified i… |
CVE-2017-5855 | Medium | 5.5 | 2017-03-01 | The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer derefere… |
CVE-2017-5854 | Medium | 5.5 | 2017-03-01 | base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. |
CVE-2017-5853 | High | 7.8 | 2017-03-01 | Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. |
CVE-2017-5852 | Medium | 5.5 | 2017-03-01 | The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite l… |