CVE-2023-52389 is a critical severity (9.8) integer overflow in the POCO C++ Libraries. Poco::UTF32Encoding can return a negative value for some input and cause a stack buffer overflow. The fix is in 1.11.8p2, 1.12.5p2 and 1.13.0, so upgrade and rebuild.
What's affected
NVD and the POCO project agree on the fixed releases: 1.11.8p2, 1.12.5p2 and 1.13.0. The POCO blog announced the two patch releases on 5 December 2023 and said they fix a long standing integer overflow bug in Poco::UTF32Encoding, advising everyone to upgrade.
The GitHub issue, number 4320, was opened on 4 December 2023 and tagged bug, fixed and security, with the milestone 1.11.8p2. Linux distributions followed with their own package updates, and Debian LTS lists one in the record's references that I did not open.
Weakness class: CWE-190.
Because POCO is a C++ library built into your own programs, the fix does not reach you through a running service alone. Programs built statically or with a bundled copy must be rebuilt.
How to check if you're exposed
Find POCO in your projects. For system packages:
dpkg -l | grep -i libpoco
rpm -qa | grep -i poco
For C++ projects, read the version from your dependency manager. With vcpkg run vcpkg list | grep poco, and with Conan check the lock file. In CMake builds, search the third party folder for a bundled copy. You can run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull this component in, directly or through another package.
What to do now
- Upgrade POCO to 1.11.8p2, 1.12.5p2, 1.13.0 or later, depending on the line you use.
- Rebuild and redeploy every program that links POCO, including static builds.
- Check embedded devices and vendor products that use POCO and ask the supplier for a fixed build.
- Use reachability analysis to see which of your services call UTF-32 conversion at all, and fix those first.
Why it matters
The POCO issue explains it: Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if the UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. Code that uses that return value as a length can then write past a buffer on the stack. That is how a conversion helper becomes a memory safety bug.
NVD scores it 9.8 with a network vector, but exposure depends on whether your program feeds untrusted UTF-32 data into that code. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which POCO versions are fixed?
1.11.8p2, 1.12.5p2 and 1.13.0, according to the CVE text and the POCO release blog.
Does updating the library package fix my application?
Only if the application uses the shared library. Statically linked or bundled copies need a rebuild.
Sources
Last reviewed: 19 October 2026.
