CVE-2026-77220

MEDIUM 6.5

PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

CWE	CWE-825
Vendor	michaelrsweet
Product	pdfio
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for michaelrsweet pdfio

Be the first to know when new medium vulnerabilities affecting michaelrsweet pdfio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

michaelrsweet / pdfio

0 < 1.6.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/michaelrsweet/pdfio/releases/tag/v1.6.5 github.com: https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357 vulncheck.com: https://www.vulncheck.com/advisories/pdfio-dangling-pointer-via-dictionary-string-formatting

Credits

Joshua Rogers (AISLE Research)