CVE-2026-44348

PoDoFo: Double-free vulnerability in compute_hash_to_sign()

2.5 LowFix available

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.10%Up 0.1 points since May 15, 2026

What each source reports

CVE List Score used 2.5

PoDoFo: Double-free vulnerability in compute_hash_to_sign()

Record: CVE-2026-44348
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-415
Updated: 2026-11-02

EUVDEUVD-2026-30337 2.5

Record: EUVD-2026-30337
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-02

NVD 2.5

Record: CVE-2026-44348
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-415
Updated: 2026-11-02

OSV 2.5

PoDoFo: Double-free vulnerability in compute_hash_to_sign()

Record: CVE-2026-44348
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-415
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-44348 2.5

Record: UBUNTU-CVE-2026-44348
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10970-1 No score

libpodofo-devel-1.1.0-1.1 on GA media

These are all security issues fixed in the libpodofo-devel-1.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10970-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2309-1 No score

Security update for podofo

This update for podofo fixes the following issue:

CVE-2026-44348: double-free in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp (bsc#1265320).

Record: SUSE-SU-2026:2309-1
Updated: 2026-11-02

Affected products

podofo

Affected packages

Affected packages
Package	Affected	Fixed
`podofo` SUSE:Linux Enterprise Module for Package Hub 15 SP7	before 1.0.2-150700.3.6.1	1.0.2-150700.3.6.1
`libpodofo` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 0.9.0-1.1ubuntu10.9.0-1.20.9.0-1.2ubuntu0.1~esm10.9.0-1.2ubuntu0.1~esm3	None known
`libpodofo` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.9.0-1.30.9.3-30.9.3-40.9.3-4ubuntu0.1~esm1	None known
`libpodofo` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.9.5-60.9.5-80.9.5-8build10.9.5-90.9.5-9ubuntu0.1~esm1	None known
`libpodofo` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 0.9.6+dfsg-50.9.6+dfsg-5build10.9.6+dfsg-5ubuntu0.1~esm1	None known
`libpodofo` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 0.9.7+dfsg-20.9.7+dfsg-2build10.9.7+dfsg-2build20.9.7+dfsg-30.9.7+dfsg-3ubuntu0.1~esm1	None known
`libpodofo` Ubuntu:24.04:LTS	All versions, plus listed versions 0.9.8+dfsg-3build10.9.8+dfsg-3build20.9.8+dfsg-3.1build10.9.8+dfsg-3.1build20.9.8+dfsg-3.1build3	None known
`libpodofo` Ubuntu:25.10	All versions, plus listed versions 0.9.8+dfsg-3.2	None known
`libpodofo` Ubuntu:26.10	All versions, plus listed versions 0.9.8+dfsg-3.30.9.8+dfsg-3.3build1	None known
`libpodofo` Ubuntu:26.04:LTS	All versions, plus listed versions 0.9.8+dfsg-3.20.9.8+dfsg-3.3	None known
`podofo` openSUSE:Tumbleweed	before 1.1.0-1.1	1.1.0-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44348 is a low vulnerability (CVSS 2.5) in Podofo, published May 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in podofo 1.0.2-150700.3.6.1.