Poco · Poco · CVE-2023-52389
**Name of the Vulnerable Software and Affected Versions**
POCO versions prior to 1.11.8p2
POCO versions prior to 1.12.5p2
POCO versions prior to 1.13.0
**Description**
The issue is caused by an integer overflow and resultant stack buffer overflow in UTF32Encoding.cpp, specifically in the `Poco::UTF32Encoding::convert()` and `Poco::UTF32::queryConvert()` functions. This occurs when a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher, potentially returning a negative integer.
**Recommendations**
For versions prior to 1.11.8p2, update to version 1.11.8p2 or later.
For versions prior to 1.12.5p2, update to version 1.12.5p2 or later.
For versions prior to 1.13.0, update to version 1.13.0 or later.