CVE-2025-9394

Name	CVE-2025-9394
Description	A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpodofo (PTS)	bullseye	0.9.7+dfsg-2	fixed
	bookworm	0.9.8+dfsg-3	fixed
	forky, sid, trixie	0.9.8+dfsg-3.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpodofo	source	(unstable)	(not affected)

Notes

- libpodofo <not-affected> (Vulnerable code introduce later)
https://github.com/podofo/podofo/issues/275
https://github.com/podofo/podofo/commit/22d16cb142f293bf956f66a4d399cdd65576d36c