CVE-2025-9394

PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after free

State: Published
Severity: 4.8 Medium
Published: Aug 24, 2025
Updated: Aug 25, 2025
Reserved: Aug 23, 2025

Description

A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-416 Use After Free
CWE-119 Memory Corruption

Affected Products

Product	Versions
PoDoFon/a	1.1.0-devAffected

References

VDB-321227 | PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after freevdb-entrytechnical-description
VDB-321227 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #632364 | podofo podofoencrypt PoDoFo version 1.1.0-dev (commit 053cf47) compiled on Jul 30 2025 and the newest master version. Heap Use-After-Freethird-party-advisory
Submit #632365 | podofo podofoencrypt PoDoFo version 1.1.0-dev (commit 053cf47) compiled on Jul 30 2025 and the newest master version. Heap Use-After-Free (Duplicate)third-party-advisory
https://github.com/podofo/podofo/issues/275issue-tracking
https://drive.google.com/file/d/1edJH17GAiK9R441Gjyj8tiV_2ptoL16U/view?usp=sharingexploit
https://github.com/podofo/podofo/commit/22d16cb142f293bf956f66a4d399cdd65576d36cpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.