CVE-2025-46205: Use After Free
A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file. NOTE: this is disputed by the Supplier because there is no available file to reproduce the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46205?
The severity of CVE-2025-46205 is critical as it can lead to a Denial of Service (DoS) when exploited.
How do I fix CVE-2025-46205?
To fix CVE-2025-46205, you should update PoDoFo to version 0.10.6 or later.
What versions of PoDoFo are affected by CVE-2025-46205?
PoDoFo versions 0.10.0 to 0.10.5 are affected by CVE-2025-46205.
What is a heap-use-after-free vulnerability in the context of CVE-2025-46205?
A heap-use-after-free vulnerability, like in CVE-2025-46205, occurs when the program attempts to use memory after it has been freed, leading to potential exploitation.
Can CVE-2025-46205 be exploited through crafted PDF files?
Yes, CVE-2025-46205 can be exploited by supplying a specially crafted PDF file to the PdfTokenizer::ReadDictionary function.