{"id":"CVE-2023-2241","summary":"PoDoFo PdfXRefStreamParserObject.cpp readXRefStreamEntry heap-based overflow","details":"A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.","modified":"2026-08-12T13:33:49.921479Z","published":"2023-04-22T16:00:04.467Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2241.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2241.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2241"},{"type":"ADVISORY","url":"https://vuldb.com/?id.227226"},{"type":"REPORT","url":"https://github.com/podofo/podofo/issues/69"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.227226"},{"type":"FIX","url":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778"},{"type":"EVIDENCE","url":"https://github.com/podofo/podofo/files/11260976/poc-file.zip"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/podofo/podofo","events":[{"introduced":"33e9719ad7e2dd11631f3af6035986c781c18748"},{"fixed":"535a786f124b739e3c857529cecc29e4eeb79778"}],"database_specific":{"cpe":"cpe:2.3:a:podofo_project:podofo:0.10.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.10.0"},{"last_affected":"0.10.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2241.json","vanir_signatures_modified":"2026-08-12T13:33:49Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778","target":{"function":"PdfXRefStreamParserObject::parseStream","file":"src/podofo/main/PdfXRefStreamParserObject.cpp"},"deprecated":false,"digest":{"function_hash":"148717897497916731819478176538687767499","length":1204},"id":"CVE-2023-2241-3d50afbb","signature_type":"Function"},{"id":"CVE-2023-2241-4863a3d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778","target":{"file":"src/podofo/main/PdfXRefStreamParserObject.cpp","function":"PdfXRefStreamParserObject::ReadXRefTable"},"deprecated":false,"digest":{"function_hash":"258192700595410644767912040996059345285","length":709}},{"digest":{"function_hash":"30657866090608528323981458188810564903","length":561},"id":"CVE-2023-2241-7ade6759","signature_type":"Function","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778","target":{"file":"src/podofo/main/PdfXRefStreamParserObject.cpp","function":"PdfXRefStreamParserObject::getIndices"},"deprecated":false},{"target":{"file":"src/podofo/main/PdfXRefStreamParserObject.cpp"},"deprecated":false,"digest":{"line_hashes":["318399739685040163889476445416612904965","62689043823046152635465642076635796780","168667730056588648547926577877443715959","165671092022511217966897716035163476976","165443548203588954427006376633279975551","13470525236190217804644301334903876530","235462649143908618157868912490010777588","192491969205640210892534018949179631290","144963411456895538384472967799335165346","23439378710046149696046839383675731238","78132239171592004613626601848792351857","296717302994419264811050973191060450583","238688401417888445778685391992570395486","188882908206609746970252112267343235132","296299666270727229391639481704564031496","261548568892764613456461128517173564175","73322821200249778374383362724243382235","321656536426526012873872408638120692993","37480660311458037287325038330873721139","26842911327849053370389349240044419002","294644321829807695335537431613132359644","336615571732040924820561059523383985277","306014107397449400198021339152706886747","21683571819985705570478622461376771588","326100675912325869297063395950204406531","108764642719094577704390524306624008981","300611949604229150107321795069181255474","242756262049749609281190191644701735136","305725275987145560965079526484312495991","172260797051853958980411290464104712166","86043215615970371869166955762199628937","16439709568491717410162544502744944791","206610658994972065980637476356172288229","45812107827922375038896710217627585548","12654551532170515890900477807752289245","23978771363502450999976884787855793447","27309862632009501853035793816295820889","17220189054693495331513367262956085641","157855063826745089109071075119552999315","44504682200891396950738387866163163997","270230267439135461929476834069283796732","198382244731724170341008168579749691658","72896030042291585536663878645791706843"],"threshold":0.9},"id":"CVE-2023-2241-b0bf695c","signature_type":"Line","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778"},{"deprecated":false,"digest":{"line_hashes":["329013899395533326817913431572772445617","248828403118159366165762683018681131620","2280154011805588324531618026250087634","40214516725554667171616348108263780408","278763234769309490372318260478221256986","205888703364553280012982155480479477381","191181404670716746710210435109202208572","207519892165232598417186148962639731542","278763234769309490372318260478221256986","205888703364553280012982155480479477381","191181404670716746710210435109202208572","207519892165232598417186148962639731542","280825452159449652661060026704313787999","238510995256753129465350100708439302285","24555774295694036522630438789473098243","59566797541591956318343204814235320081","278763234769309490372318260478221256986","205888703364553280012982155480479477381","191181404670716746710210435109202208572","207519892165232598417186148962639731542","278763234769309490372318260478221256986","205888703364553280012982155480479477381","191181404670716746710210435109202208572","207519892165232598417186148962639731542","278763234769309490372318260478221256986","205888703364553280012982155480479477381","191181404670716746710210435109202208572","207519892165232598417186148962639731542"],"threshold":0.9},"id":"CVE-2023-2241-cefa4ca7","signature_type":"Line","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778","target":{"file":"test/unit/ParserTest.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}