CVE-2026-44348: Podofo

Low severity, CVSS 2.5. EPSS: 0.1% chance of exploitation in the next 30 days.

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.

Affected products

• Podofo Podofo: from 1.0.0, before 1.0.4 (fixed in 1.0.4)

Published 2026-05-14. Last modified 2026-06-17.