CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. Versions 1.0.0 through 1.1.1 are affected by a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine (src/podofo/main/PdfColorSpaceFilter.cpp). The root cause is that PODOFO_INVARIANT does not perform a runtime check, allowing a pixel ind...