{"id":"CVE-2026-54633","summary":"PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)","details":"PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. PdfColorSpaceFilterFactory::TryCreateFromObject also validates hival with an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range. The resulting read can disclose adjacent heap data or crash the processing application. This issue is fixed in version 1.1.1.","aliases":["GHSA-f3j2-7846-h5gg"],"modified":"2026-10-28T11:09:55.458898773Z","published":"2026-09-17T21:36:45.592Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54633.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/podofo/podofo/releases/tag/1.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54633.json"},{"type":"ADVISORY","url":"https://github.com/podofo/podofo/security/advisories/GHSA-f3j2-7846-h5gg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54633"},{"type":"FIX","url":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/podofo/podofo","events":[{"introduced":"04ea33e8d97b99d02498f434125a42b6c18f5569"},{"fixed":"40887e79e08d262189b15a532a17d074e02fc0e3"},{"fixed":"999c519d285c4a65eba48409d9cd2da9d4743cca"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"999c519d285c4a65eba48409d9cd2da9d4743cca"}]},{"original_tag":"1.1.1","range":[{"fixed":"40887e79e08d262189b15a532a17d074e02fc0e3"}],"source":"REFERENCES_TAG"}]}}],"versions":["1.1.0","1.0.1","1.0.1-rc1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54633.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["207027947562570262320273159766644518046","26239047239637940211851668748158814209","184666923924047388550000331944834973804","187745807390072929537182304525345649061","165980709556548348272868659171353364629","204398839016408352855884251311868661918","122318432428525596848226494352678023637","265127585993943918486992479857191282646","51660648995065696602144023771609478582"],"threshold":0.9},"id":"CVE-2026-54633-2aa81c18","signature_type":"Line","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca","target":{"file":"src/podofo/main/PdfColorSpaceFilter.cpp"}},{"target":{"function":"PdfColorSpaceFilterIndexed::FetchScanLine","file":"src/podofo/main/PdfColorSpaceFilter.cpp"},"deprecated":false,"digest":{"function_hash":"254570722173001623058602792590739993393","length":804},"id":"CVE-2026-54633-c93c85cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca"},{"source":"https://github.com/podofo/podofo/commit/999c519d285c4a65eba48409d9cd2da9d4743cca","target":{"function":"PdfColorSpaceFilterFactory::TryCreateFromObject","file":"src/podofo/main/PdfColorSpaceFilter.cpp"},"deprecated":false,"digest":{"function_hash":"310184013749674251260211784292248321864","length":1854},"id":"CVE-2026-54633-ec453e74","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-28T11:09:55Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}