PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5853 Podofo Project CVE debrief

CVE-2017-5853 affects PoDoFo 0.9.4 and is described as an integer overflow in base/PdfParser.cpp triggered by a crafted file. The public record assigns a high-severity score and indicates potential high impact on confidentiality, integrity, and availability, so any software that parses untrusted PDFs with this library should be treated as exposed until remediated.

Vendor
Podofo Project
Product
CVE-2017-5853
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Developers, product owners, and security teams that use PoDoFo 0.9.4 or embed it in applications that process PDF files from users, customers, or other untrusted sources.

Technical summary

The NVD record classifies the issue as CWE-190 (integer overflow) and maps it to PoDoFo 0.9.4 via the CPE cpe:2.3:a:podofo_project:podofo:0.9.4:*:*:*:*:*:*:*. The description says a crafted file can lead to unspecified impact in base/PdfParser.cpp. NVD also provides CVSS v3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which suggests user interaction is required and the attack context is local rather than remote.

Defensive priority

High. Prioritize any system that accepts or auto-processes untrusted PDF content, especially if PoDoFo 0.9.4 is present in a production or internet-facing workflow.

Recommended defensive actions

  • Inventory applications and services that include or depend on PoDoFo 0.9.4.
  • Confirm whether your build uses a vendor-fixed or otherwise non-vulnerable PoDoFo release.
  • Restrict or sandbox PDF parsing paths that handle untrusted input.
  • Add file validation and safety checks around any PDF ingestion workflow.
  • Monitor dependent projects and distributions for remediation guidance tied to this CVE.

Evidence notes

Supported by the NVD record and CVE references: the vulnerable product/version is PoDoFo 0.9.4; the weakness is CWE-190; and the CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The textual description says 'remote attackers' while the CVSS vector indicates a local attack requiring user interaction, so the public sources differ on attack context. Impact is otherwise left unspecified in the description.

Official resources

Publicly listed on 2017-03-01; the NVD record was later modified on 2026-05-13.