What is the CVSS score of CVE-2026-44348?

CVE-2026-44348 has a CVSS 3.1 base score of 2.5 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44348?

Yes, a patch is available for CVE-2026-44348. Update the affected software to the latest version immediately.

PoDoFo CVE-2026-44348

EUVD-2026-30337 LOW

Double Free (CWE-415)

2026-05-14 GitHub_M

Information Disclosure Podofo

2.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.5 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

May 14, 2026 - 18:02 EUVD

Source Code Evidence Fetched

May 14, 2026 - 17:34 vuln.today

Analysis Generated

May 14, 2026 - 17:34 vuln.today

CVE Published

May 14, 2026 - 16:38 nvd

LOW 2.5

DescriptionGitHub Advisory

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.

AnalysisAI

Double-free vulnerability in PoDoFo 1.0.0 through 1.0.3 allows local attackers with user interaction to trigger heap corruption via failed digest operations in PDF signing routines, potentially causing denial of service. The vulnerability exists in compute_hash_to_sign() where EVP_DigestFinal failure causes buf to be freed twice, corrupting heap metadata. CVSS score is 2.5 (low severity) but exploitation requires local access and user interaction. Patched in version 1.0.4.

Technical ContextAI

PoDoFo is a C++17 library for PDF manipulation, including digital signature operations. The vulnerability resides in compute_hash_to_sign() within src/podofo/private/OpenSSLInternal_Ripped.cpp, which handles cryptographic hash computation for PDF signing using OpenSSL's EVP (Envelope) interface. The root cause is a classic double-free (CWE-415) resulting from improper error handling: when EVP_DigestFinal fails, execution jumps to the Error label, which attempts to free buf a second time without checking if buf was already freed during the failed operation. This corrupts the heap allocator's metadata, potentially triggering crash or undefined behavior. The affected library versions 1.0.0 through 1.0.3 contain this flaw in the PDF signature workflow, likely triggered when processing malformed or specially crafted PDF documents.

RemediationAI

Upgrade PoDoFo to version 1.0.4 or later, which includes the fix (commit 696d765c3a71ef224d4abffe1f174fef11292d7e adding buf = nullptr to prevent double-free). If immediate upgrade is not feasible, limit processing of PDF documents to trusted sources only and implement input validation to reject malformed or suspicious PDFs before passing them to PoDoFo signing routines. Monitor application logs for crashes or heap corruption warnings (e.g., ASAN or Valgrind output) in signature operations, which may indicate exploitation attempts. Refer to the vendor advisory at https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72 for additional context and confirmation of the patch.