CVE-2018-14320

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5673.

• CWE-119
• CWE-119

• https://zerodayinitiative.com/advisories/ZDI-18-1046Third Party Advisory, VDB Entry
• https://zerodayinitiative.com/advisories/ZDI-18-1046Third Party Advisory, VDB Entry

Published

Sep 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14314This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-14315This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-14316This vulnerability allows remote attackers to disclose sensi…
• CVE-2018-14317This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-14318This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-1432IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 …6.1
• CVE-2018-14324The demo feature in Oracle GlassFish Open Source Edition 5.0…
• CVE-2018-14325In MP4v2 2.0.0, there is an integer underflow (with resultan…
• CVE-2018-14326In MP4v2 2.0.0, there is an integer overflow (with resultant…
• CVE-2018-14327The installer for the Alcatel OSPREY3_MINI Modem component o…
• CVE-2018-14328Brynamics "Online Trade - Online trading and cryptocurrency …
• CVE-2018-14329In HTSlib 1.8, a race condition in cram/cram_io.c might allo…4.7