CVE-2026-44348: PoDoFo: Double-free vulnerability in compute_hash_to_sign()
PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in computehashtosign() in src/podofo/private/OpenSSLInternalRipped.cpp. If EVPDigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44348?
CVE-2026-44348 is classified as a high-severity vulnerability due to the potential for a double-free condition leading to application crashes or arbitrary code execution.
How do I fix CVE-2026-44348?
To mitigate CVE-2026-44348, upgrade PoDoFo to version 1.0.4 or later, where the vulnerability has been addressed.
What causes CVE-2026-44348?
CVE-2026-44348 is caused by a double-free vulnerability in the compute_hash_to_sign() function within the PoDoFo library's OpenSSL integration.
What systems are affected by CVE-2026-44348?
CVE-2026-44348 affects all versions of PoDoFo from 1.0.0 to before 1.0.4 that utilize the compute_hash_to_sign() function.
Is CVE-2026-44348 a remote exploit?
CVE-2026-44348 is not a remote exploit but can be exploited locally if an application using the vulnerable PoDoFo library experiences the double-free issue.