PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5852 Podofo Project CVE debrief

CVE-2017-5852 is a denial-of-service issue in PoDoFo 0.9.4 where a crafted PDF can drive PoDoFo::PdfPage::GetInheritedKeyFromObject into an infinite loop. The result is availability impact only; the NVD record assigns CVSS 3.0 5.5 (MEDIUM) with a vector that indicates local access and user interaction.

Vendor
Podofo Project
Product
Podofo
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Organizations and developers that parse or process untrusted PDF files with PoDoFo 0.9.4 should pay attention, especially if the library is used in desktop tools, document pipelines, or file-conversion workflows.

Technical summary

The vulnerable function is PoDoFo::PdfPage::GetInheritedKeyFromObject in base/PdfVariant.cpp. NVD maps the issue to CWE-835 (infinite loop) and lists PoDoFo 0.9.4 as the affected version. A crafted file can cause the parser to loop indefinitely, exhausting processing resources and denying service. The supplied record description says "remote attackers" may trigger the issue, while the CVSS vector is AV:L/PR:N/UI:R, so the record should be read carefully in context.

Defensive priority

Medium. This is an availability-only issue, but it can still stall services or crash workflows that handle untrusted PDFs. Priority increases where PoDoFo processes externally supplied files or where parsing hangs would impact user-facing operations.

Recommended defensive actions

  • Confirm whether PoDoFo 0.9.4 is in use anywhere in your environment.
  • Upgrade or replace the vulnerable PoDoFo version if a fixed release is available from your software vendor or package maintainer.
  • Treat untrusted PDF inputs as high-risk and isolate parsing in a constrained process or service.
  • Add timeouts, watchdogs, or job supervision around PDF processing to limit the effect of hangs.
  • Review any workflows that automatically ingest PDFs from external sources and reduce exposure where possible.

Evidence notes

The vulnerability description and NVD record identify an infinite loop in PoDoFo::PdfPage::GetInheritedKeyFromObject affecting PoDoFo 0.9.4. NVD lists CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and CWE-835. The record was published on 2017-03-01, with supporting references dated 2017-02-01 and 2017-02-02. Note that the human-readable description mentions remote attackers, while the CVSS vector indicates local access with user interaction; that context mismatch is reflected here rather than resolved by assumption.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5852 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5852

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5852 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5852

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.