CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357
https://github.com/michaelrsweet/pdfio/releases/tag/v1.6.5
https://www.vulncheck.com/advisories/pdfio-dangling-pointer-via-dictionary-string-formatting

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) PDFio anterior a 1.6.5 contiene una vulnerabilidad de puntero colgante en la función de formato de cadenas del diccionario que almacena un puntero a un búfer local de pila en el diccionario del documento sin copiar el valor de la cadena. En entornos multiproceso o de solicitudes agrupadas, los atacantes o usuarios concurrentes pueden desencadenar la reutilización de la memoria de la pila entre solicitudes, causando corrupción del contenido del documento entre inquilinos al sobrescribir silenciosamente los valores de cadena del diccionario de un llamador con los datos de otro llamador.

Information

Published : 2026-08-21 21:17

Updated : 2026-10-12 16:10

NVD link : CVE-2026-77220

Mitre link : CVE-2026-77220

CVE.ORG link : CVE-2026-77220

JSON object : View

Products Affected

No product.

CWE

CWE-825

Expired Pointer Dereference

{"id": "CVE-2026-77220", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77220", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:40:29.774950Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/michaelrsweet/pdfio", "vendor": "michaelrsweet", "product": "pdfio", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.5", "versionType": "semver"}], "packageURL": "pkg:github/michaelrsweet/pdfio", "defaultStatus": "affected"}]}], "published": "2026-08-21T21:17:06.737", "references": [{"url": "https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/michaelrsweet/pdfio/releases/tag/v1.6.5", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/pdfio-dangling-pointer-via-dictionary-string-formatting", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data."}, {"lang": "es", "value": "PDFio anterior a 1.6.5 contiene una vulnerabilidad de puntero colgante en la funci\u00f3n de formato de cadenas del diccionario que almacena un puntero a un b\u00fafer local de pila en el diccionario del documento sin copiar el valor de la cadena. En entornos multiproceso o de solicitudes agrupadas, los atacantes o usuarios concurrentes pueden desencadenar la reutilizaci\u00f3n de la memoria de la pila entre solicitudes, causando corrupci\u00f3n del contenido del documento entre inquilinos al sobrescribir silenciosamente los valores de cadena del diccionario de un llamador con los datos de otro llamador."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}