{"id":"CVE-2026-54633","summary":"PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)","details":"PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. PdfColorSpaceFilterFactory::TryCreateFromObject also validates hival with an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range. The resulting read can disclose adjacent heap data or crash the processing application. This issue is fixed in version 1.1.1.","aliases":["GHSA-f3j2-7846-h5gg"],"modified":"2026-09-23T08:12:40.618119Z","published":"2026-09-17T21:36:45.592Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54633.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/podofo/podofo/releases/tag/1.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54633.json"},{"type":"ADVISORY","url":"https://github.com/podofo/podofo/security/advisories/GHSA-f3j2-7846-h5gg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54633"},{"type":"FIX","url":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/podofo/podofo","events":[{"introduced":"04ea33e8d97b99d02498f434125a42b6c18f5569"},{"fixed":"999c519d285c4a65eba48409d9cd2da9d4743cca"},{"fixed":"40887e79e08d262189b15a532a17d074e02fc0e3"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.1.0","1.0.1","1.0.1-rc1","1.0.0"],"database_specific":{"vanir_signatures_modified":"2026-09-23T08:12:40Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca","target":{"file":"src/podofo/main/PdfColorSpaceFilter.cpp"},"deprecated":false,"digest":{"line_hashes":["207027947562570262320273159766644518046","26239047239637940211851668748158814209","184666923924047388550000331944834973804","187745807390072929537182304525345649061","165980709556548348272868659171353364629","204398839016408352855884251311868661918","122318432428525596848226494352678023637","265127585993943918486992479857191282646","51660648995065696602144023771609478582"],"threshold":0.9},"id":"CVE-2026-54633-2aa81c18"},{"signature_version":"v1","source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca","target":{"file":"src/podofo/main/PdfColorSpaceFilter.cpp","function":"PdfColorSpaceFilterIndexed::FetchScanLine"},"deprecated":false,"digest":{"function_hash":"254570722173001623058602792590739993393","length":804},"id":"CVE-2026-54633-c93c85cc","signature_type":"Function"},{"id":"CVE-2026-54633-ec453e74","signature_type":"Function","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca","target":{"file":"src/podofo/main/PdfColorSpaceFilter.cpp","function":"PdfColorSpaceFilterFactory::TryCreateFromObject"},"deprecated":false,"digest":{"function_hash":"310184013749674251260211784292248321864","length":1854}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54633.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}