Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54633PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)

Medium 6.9

In plain English

A medium-severity out-of-bounds read in podofo from podofo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.2%top 92.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. PdfColorSpaceFilterFactory::TryCreateFromObject also validates hival with an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range. The resulting read can disclose adjacent heap data or crash the processing application. This issue is fixed in version 1.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:24.04:LTS	libpodofo	no fix listed	UBUNTU-CVE-2026-54633
Ubuntu:26.04:LTS	libpodofo	no fix listed	UBUNTU-CVE-2026-54633
Ubuntu:26.10	libpodofo	no fix listed	UBUNTU-CVE-2026-54633

Affected products (as reported)

Vendor	Product	Versions
podofo	podofo	>= 1.0.0, < 1.1.1

Weakness: CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/podofo/podofo/security/advisories/GHSA-f3j2-7846-h5gg x_refsource_CONFIRM
https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca x_refsource_MISC
https://github.com/podofo/podofo/releases/tag/1.1.1 x_refsource_MISC