Medium severity · published Aug 24, 2025
CVE-2025-9394
PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after free
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PoDoFo ·
1.1.0-dev · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9394
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9394
Exploit
https://drive.google.com/file/d/1edJH17GAiK9R441Gjyj8tiV_2ptoL16U/view?usp=sharing
Patch
https://github.com/podofo/podofo/commit/22d16cb142f293bf956f66a4d399cdd65576d36c
Exploit
https://github.com/podofo/podofo/issues/275
Permissions Required
https://vuldb.com/?ctiid.321227
Third Party Advisory
https://vuldb.com/?id.321227
Exploit
https://vuldb.com/?submit.632364