CVE-2026-77220: PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to cross-tenant corruption?
Multi-threaded or pooled-request environments are specifically exposed because stack memory can be reused across requests. This can cause one caller's document dictionary string values to be silently overwritten with data from another caller.
What access does an attacker need to exploit this issue?
The listed vector requires network access and low privileges, with no user interaction. The issue affects confidentiality only indirectly through cross-request data reuse; the provided impact rating identifies integrity as affected and confidentiality and availability as not affected.
Are current PDFio releases affected?
The issue affects PDFio versions before 1.6.5. Updating to version 1.6.5 or later removes the affected version range.