Podofo Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-46205 A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplyingHigh 8.1 · Oct 1, 2025
• CVE-2023-31568 Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4.High 8.8 · May 10, 2023
• CVE-2023-31567 Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.High 8.8 · May 10, 2023
• CVE-2023-31566 Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().High 8.8 · May 10, 2023
• CVE-2021-30472 A flaw was found in PoDoFo 0.9.7.High 7.8 · May 26, 2021
• CVE-2019-9687 PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.Critical 9.8 · Mar 11, 2019
• CVE-2019-9199 PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a High 8.8 · Feb 26, 2019
• CVE-2018-20751 An issue was discovered in crop_page in PoDoFo 0.9.6.High 8.8 · Feb 4, 2019
• CVE-2018-19532 A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, High 8.8 · Nov 25, 2018
• CVE-2018-12983 A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attaHigh 7.8 · Jun 29, 2018
• CVE-2018-8002 In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.cpp which may result in stack overflow.High 8.8 · Mar 9, 2018
• CVE-2018-8001 In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp.High 7.8 · Mar 9, 2018
• CVE-2018-8000 In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-201High 8.8 · Mar 9, 2018
• CVE-2018-5308 PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp).High 7.8 · Jan 9, 2018
• CVE-2017-8787 The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause aHigh 8.8 · May 5, 2017
• CVE-2017-8378 Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (apCritical 9.8 · Apr 30, 2017
• CVE-2015-8981 Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectorsCritical 9.8 · Mar 16, 2017
• CVE-2017-6844 Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a High 7.8 · Mar 15, 2017
• CVE-2017-6843 Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact viHigh 7.8 · Mar 15, 2017
• CVE-2017-5886 Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified imHigh 7.8 · Mar 1, 2017
• CVE-2017-5853 Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.High 7.8 · Mar 1, 2017