PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5854 Podofo Project CVE debrief

CVE-2017-5854 is a denial-of-service vulnerability in PoDoFo 0.9.4 tied to a NULL pointer dereference in base/PdfOutputStream.cpp. The NVD record rates it medium severity and classifies the impact as availability-only. In practice, the issue is relevant anywhere PoDoFo is used to open or process untrusted PDF content, especially in workflows where a crafted file may be handled by a user or automated job.

Vendor
Podofo Project
Product
Podofo
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Teams that ship, embed, or operationally depend on PoDoFo 0.9.4 should care, especially document-processing services, desktop applications, conversion pipelines, and security tools that ingest untrusted PDFs or other crafted files.

Technical summary

The NVD record describes a NULL pointer dereference in base/PdfOutputStream.cpp in PoDoFo 0.9.4, triggered by a crafted file and resulting in a crash. The mapped weakness is CWE-476 (NULL Pointer Dereference). NVD’s CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, which indicates no confidentiality or integrity impact, high availability impact, and a user-interaction requirement. The source description also says remote attackers can cause a denial of service, so defenders should treat the exploit path as input-driven and file-centric, while relying on the CVSS vector for exposure characteristics.

Defensive priority

Medium. This is a crash/availability issue rather than a code-execution flaw, but it can still disrupt services or workflows that process untrusted files. Prioritize if PoDoFo 0.9.4 is exposed to external content or used in automated ingestion.

Recommended defensive actions

  • Inventory systems using PoDoFo 0.9.4 and identify any path that processes untrusted files.
  • Upgrade or patch PoDoFo to a fixed release if available from your vendor or upstream.
  • If immediate upgrading is not possible, restrict who can submit files for processing and add pre-ingestion controls for untrusted documents.
  • Monitor document-processing services for unexpected crashes or repeated failures that may indicate malformed-input handling issues.
  • Validate that any PDF-handling pipeline runs with least privilege and can recover cleanly from parser crashes.

Evidence notes

Primary source: NVD record for CVE-2017-5854, published 2017-03-01 and modified 2026-05-13. The NVD CPE entry identifies PoDoFo 0.9.4 as vulnerable. Supporting references include the Gentoo advisory on 2017-02-01 and OSS-security follow-up references on 2017-02-01 and 2017-02-02. The official record maps the weakness to CWE-476 and gives the CVSS v3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5854 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5854

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5854 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5854

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.