The vulnerability arises when PoDoFo’s compute_hash_to_sign() function in OpenSSLInternal_Ripped.cpp performs a double‑free. If EVP_DigestFinal fails after the temporary buffer has already been freed, the error handling code frees the same buffer again, corrupting heap memory. The issue is classified as CWE‑415 and is limited to causing heap corruption; the CVE description does not state that it enables code execution or other more severe impacts.

PoDoFo library releases from version 1.0.0 through 1.0.3 are affected. The double‑free flaw was fixed in version 1.0.4 and later, which removes the secondary free path.

The CVSS score of 2.5 indicates low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an application using PoDoFo parses a PDF that triggers EVP_DigestFinal to fail after freeing the buffer, which limits the attack to scenarios where untrusted PDF data is processed. The overall risk is therefore confined to applications that handle potentially malicious PDFs and does not involve direct remote code execution or widespread availability impact.