PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5853 Podofo Project CVE debrief

CVE-2017-5853 affects PoDoFo 0.9.4 and is described as an integer overflow in base/PdfParser.cpp triggered by a crafted file. The public record assigns a high-severity score and indicates potential high impact on confidentiality, integrity, and availability, so any software that parses untrusted PDFs with this library should be treated as exposed until remediated.

Vendor
Podofo Project
Product
Podofo
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Developers, product owners, and security teams that use PoDoFo 0.9.4 or embed it in applications that process PDF files from users, customers, or other untrusted sources.

Technical summary

The NVD record classifies the issue as CWE-190 (integer overflow) and maps it to PoDoFo 0.9.4 via the CPE cpe:2.3:a:podofo_project:podofo:0.9.4:*:*:*:*:*:*:*. The description says a crafted file can lead to unspecified impact in base/PdfParser.cpp. NVD also provides CVSS v3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which suggests user interaction is required and the attack context is local rather than remote.

Defensive priority

High. Prioritize any system that accepts or auto-processes untrusted PDF content, especially if PoDoFo 0.9.4 is present in a production or internet-facing workflow.

Recommended defensive actions

  • Inventory applications and services that include or depend on PoDoFo 0.9.4.
  • Confirm whether your build uses a vendor-fixed or otherwise non-vulnerable PoDoFo release.
  • Restrict or sandbox PDF parsing paths that handle untrusted input.
  • Add file validation and safety checks around any PDF ingestion workflow.
  • Monitor dependent projects and distributions for remediation guidance tied to this CVE.

Evidence notes

Supported by the NVD record and CVE references: the vulnerable product/version is PoDoFo 0.9.4; the weakness is CWE-190; and the CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The textual description says 'remote attackers' while the CVSS vector indicates a local attack requiring user interaction, so the public sources differ on attack context. Impact is otherwise left unspecified in the description.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5853 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5853

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5853 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5853

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.