CVE-2026-44348CWE-415

PoDoFo: Double-free vulnerability in compute_hash_to_sign()

Low · published May 14, 2026

CVSS v3.1
2.5
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-415 · Double Free
Published
2026-05-14T16:38Z
EPSS history
Timeline
  • 14 MAY 16:38Z
    PoDoFo: Double-free vulnerability in compute_hash_to_sign()
    cvelistv5