https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:08:02.058961+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44348 CVE-2026-44348 — PoDoFo: Double-free vulnerability in compute_hash_to_sign() 2026-10-06T23:08:02.060410+00:00

Affected: podofo

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.