CVE-2023-52389: Pocoproject Poco

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Affected products

• Pocoproject Poco: before 1.11.8 (fixed in 1.11.8); from 1.12.0, before 1.12.5 (fixed in 1.12.5); version 1.11.8 only; version 1.12.5 only

Published 2024-01-27. Last modified 2026-06-17.