CVE-2023-2241

A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.

• CWE-122
• CWE-787
• CWE-120

• https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778Patch
• https://github.com/podofo/podofo/files/11260976/poc-file.zipExploit
• https://github.com/podofo/podofo/issues/69Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.227226Third Party Advisory
• https://vuldb.com/?id.227226Third Party Advisory
• https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778Patch
• https://github.com/podofo/podofo/files/11260976/poc-file.zipExploit
• https://github.com/podofo/podofo/issues/69Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.227226Third Party Advisory
• https://vuldb.com/?id.227226Third Party Advisory

Published

Apr 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22404An Out-of-bounds Write vulnerability in the Internet Key Exc…6.5
• CVE-2023-22405An Improper Preservation of Consistency Between Independent …6.5
• CVE-2023-22406A Missing Release of Memory after Effective Lifetime vulnera…6.5
• CVE-2023-22407An Incomplete Cleanup vulnerability in the Routing Protocol …6.5
• CVE-2023-22408An Improper Validation of Array Index vulnerability in the S…7.5
• CVE-2023-22409An Unchecked Input for Loop Condition vulnerability in a NAT…5.5
• CVE-2023-22410A Missing Release of Memory after Effective Lifetime vulnera…6.5
• CVE-2023-22411An Out-of-Bounds Write vulnerability in Flow Processing Daem…7.5
• CVE-2023-22412An Improper Locking vulnerability in the SIP ALG of Juniper …7.5
• CVE-2023-22413An Improper Check or Handling of Exceptional Conditions vuln…7.5
• CVE-2023-22414A Missing Release of Memory after Effective Lifetime vulnera…6.5
• CVE-2023-22415An Out-of-Bounds Write vulnerability in the H.323 ALG of Jun…7.5