CVE-2023-52389

Name of the Vulnerable Software and Affected Versions POCO versions prior to 1.11.8p2 POCO versions prior to 1.12.5p2 POCO versions prior to 1.13.0

Description The issue is caused by an integer overflow and resultant stack buffer overflow in UTF32Encoding.cpp, specifically in the Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() functions. This occurs when a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher, potentially returning a negative integer.

Recommendations For versions prior to 1.11.8p2, update to version 1.11.8p2 or later. For versions prior to 1.12.5p2, update to version 1.12.5p2 or later. For versions prior to 1.13.0, update to version 1.13.0 or later.