PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5886 Podofo Project CVE debrief

CVE-2017-5886 describes a heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken in PdfTokenizer.cpp affecting PoDoFo 0.9.4. The vulnerability is associated with processing a crafted file and is rated HIGH by NVD (CVSS 7.8). In the supplied NVD data, the CVSS vector models the issue as requiring local access and user interaction, so defenders should treat it as a high-risk document-parsing flaw rather than assume fully unauthenticated remote exploitation.

Vendor
Podofo Project
Product
Podofo
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Teams that embed PoDoFo for PDF parsing or conversion, especially services or desktop tools that open PDFs from untrusted sources. Security teams should also care if PoDoFo 0.9.4 is present in packaged software, downstream distributions, or CI/test pipelines that process attacker-controlled files.

Technical summary

The flaw is a CWE-119 heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken within PdfTokenizer.cpp. The CVE description says a crafted file can trigger unspecified impact, and NVD identifies PoDoFo 0.9.4 as the affected version. NVD’s CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which indicates user interaction is needed and helps frame the risk as file-opening or file-processing exposure.

Defensive priority

High priority for any environment that processes PDFs from outside the trust boundary. The issue affects core parsing logic, can be triggered by crafted input, and is scored HIGH in NVD.

Recommended defensive actions

  • Inventory all products, services, and builds that include PoDoFo 0.9.4 or bundle PoDoFo for PDF processing.
  • Upgrade to a vendor-fixed or otherwise non-vulnerable PoDoFo release as soon as one is available; if no supported fix exists, remove or replace the dependency.
  • Isolate PDF parsing in a sandbox, container, or low-privilege process so a parsing crash or memory corruption has limited blast radius.
  • Restrict automatic opening or processing of untrusted PDFs and require user approval for external documents where possible.
  • Monitor for crashes or abnormal behavior in PDF ingestion paths and treat malformed PDF samples as security-relevant telemetry.

Evidence notes

Primary facts come from the CVE record and NVD entry: PoDoFo 0.9.4 is affected; the flaw is a heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken; the weakness is classified as CWE-119; and the NVD CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVE description mentions a crafted file and unspecified impact. The supplied data does not include a vendor fix version.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5886 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5886

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5886 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5886

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://blogs.gentoo.org/ago/2017/02/03/podofo-heap-based-buffer-overflow-in-podofopdftokenizergetnexttoken-pdftokenizer-cpp/

    [email protected] - Third Party Advisory, VDB Entry

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.