A heap use-after-free vulnerability in PoDoFo versions 0.10.0 through 0.10.5 presents a risk of application instability and potential unauthorized memory interaction.

This is a heap use-after-free flaw located in the PdfTokenizer::ReadDictionary function. An unauthenticated attacker can trigger the vulnerability by providing a specially crafted PDF file to the application.

The vulnerability carries a CVSS score of 8.1, indicating a high level of concern despite the vendor's current dispute regarding reproducibility. Successful exploitation could lead to application crashes or potential memory corruption, disrupting critical document processing workflows and availability.

Immediate Action: Since no official patch is currently confirmed, organizations should restrict the processing of untrusted PDF files by PoDoFo-based applications until further guidance or a security update is released.

Proactive Monitoring: Monitor application logs for unexpected crashes or error messages specifically associated with PDF parsing modules or tokenizer functions.

Compensating Controls: Deploy file integrity scanners or sandboxed environments to analyze incoming PDF documents before they are processed by the PoDoFo library.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research report linked within the CVE references.

Given the existence of a proof-of-concept and the high CVSS severity, users should exercise caution when handling PDF files from external sources. Security teams are advised to monitor the upstream PoDoFo GitHub repository for official patch releases and apply them immediately upon availability to mitigate the risk of memory-related exploitation.