CVE-2026-44348

creationtimestamp| type| source ---|---|--- 2026-05-16 11:46:51+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mlxrlcxp2r2b...

CVE-2026-44348

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in computehashtosign in src/podofo/private/OpenSSLInternalRipped.cpp. If EVPDigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap...