CVE-2023-2241 PoDoFo PdfXRefStreamParserObject.cpp readXRefStreamEntry heap-based overflow
A heap-based buffer overflow in PoDoFo allows local attackers to execute arbitrary code or cause denial of service via crafted PDF files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2241?
CVE-2023-2241 is a medium-severity memory corruption vulnerability in Podofo Project Podofo, published on 22 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.
Which versions are affected by CVE-2023-2241?
It affects 1 product.
Products include Podofo Project Podofo.
How do I fix CVE-2023-2241?
No fix has been published for CVE-2023-2241 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-2241 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2241 exists.
Other vulnerabilities in Podofo Project Podofo
Sources
Also known as GHSA-v8x8-32r8-5x52.