CVE-2026-54633: PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)
PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a runtime check, so a pixel index greater than or equal to mMapSize can address beyond mlookup. PdfColorSpaceFilterFactory::TryCreateFromObject also validates hival with an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range. The resulting read can disclose adjacent heap data or crash the processing application. This issue is fixed in version 1.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PoDoFoto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using PoDoFo versions 1.0.0 through 1.1.1 are affected when they process attacker-controlled or otherwise malformed PDFs containing an Indexed color-space image.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted PDF with malformed Indexed color-space metadata or pixel indices that exceed the color lookup map. Exploitation occurs when the application processes that PDF.
What is the impact on a vulnerable application?
The out-of-bounds read can disclose adjacent heap data or cause the PDF-processing application to crash.
What should be done if vulnerable versions are in use?
Update PoDoFo to version 1.1.1, which fixes the issue. Until updating, avoid processing untrusted PDFs, particularly PDFs containing Indexed color-space images.