PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5886 Podofo Project CVE debrief

CVE-2017-5886 describes a heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken in PdfTokenizer.cpp affecting PoDoFo 0.9.4. The vulnerability is associated with processing a crafted file and is rated HIGH by NVD (CVSS 7.8). In the supplied NVD data, the CVSS vector models the issue as requiring local access and user interaction, so defenders should treat it as a high-risk document-parsing flaw rather than assume fully unauthenticated remote exploitation.

Vendor
Podofo Project
Product
CVE-2017-5886
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Teams that embed PoDoFo for PDF parsing or conversion, especially services or desktop tools that open PDFs from untrusted sources. Security teams should also care if PoDoFo 0.9.4 is present in packaged software, downstream distributions, or CI/test pipelines that process attacker-controlled files.

Technical summary

The flaw is a CWE-119 heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken within PdfTokenizer.cpp. The CVE description says a crafted file can trigger unspecified impact, and NVD identifies PoDoFo 0.9.4 as the affected version. NVD’s CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which indicates user interaction is needed and helps frame the risk as file-opening or file-processing exposure.

Defensive priority

High priority for any environment that processes PDFs from outside the trust boundary. The issue affects core parsing logic, can be triggered by crafted input, and is scored HIGH in NVD.

Recommended defensive actions

  • Inventory all products, services, and builds that include PoDoFo 0.9.4 or bundle PoDoFo for PDF processing.
  • Upgrade to a vendor-fixed or otherwise non-vulnerable PoDoFo release as soon as one is available; if no supported fix exists, remove or replace the dependency.
  • Isolate PDF parsing in a sandbox, container, or low-privilege process so a parsing crash or memory corruption has limited blast radius.
  • Restrict automatic opening or processing of untrusted PDFs and require user approval for external documents where possible.
  • Monitor for crashes or abnormal behavior in PDF ingestion paths and treat malformed PDF samples as security-relevant telemetry.

Evidence notes

Primary facts come from the CVE record and NVD entry: PoDoFo 0.9.4 is affected; the flaw is a heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken; the weakness is classified as CWE-119; and the NVD CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVE description mentions a crafted file and unspecified impact. The supplied data does not include a vendor fix version.

Official resources

Publicly disclosed on 2017-03-01T15:59:01.103Z. The supplied NVD record was modified on 2026-05-13T00:24:29.033Z. No KEV entry is present in the supplied data.