{"id":"CVE-2026-77220","summary":"PDFio \u003c 1.6.5 Dangling Pointer via Dictionary String-Formatting","details":"PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.","modified":"2026-08-27T19:14:10.854759Z","published":"2026-08-21T20:54:34.762Z","database_specific":{"cwe_ids":["CWE-825"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77220.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77220.json"},{"type":"ADVISORY","url":"https://github.com/michaelrsweet/pdfio/releases/tag/v1.6.5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77220"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pdfio-dangling-pointer-via-dictionary-string-formatting"},{"type":"FIX","url":"https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357"},{"type":"PACKAGE","url":"https://github.com/michaelrsweet/pdfio"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/michaelrsweet/pdfio","events":[{"introduced":"0"},{"fixed":"5102eddff28d9b605f3e6783d50ad380f61f692e"},{"fixed":"22b9afc800c5833f9e851e35938972bd4c76a357"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.6.5"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.1","v1.0.0","v1.0b2","v1.0b1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77220.json","vanir_signatures_modified":"2026-08-27T19:14:10Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357","target":{"file":"pdfio-dict.c"},"deprecated":false,"digest":{"line_hashes":["206220656076517917598020857657619829177","303718665690998273257748695389723119175","326349271487051918019348789262440632780","288685422910406038857624548261886084666"],"threshold":0.9},"id":"CVE-2026-77220-8ebc7005","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/pdfio/commit/5102eddff28d9b605f3e6783d50ad380f61f692e","target":{"file":"pdfio.h"},"deprecated":false,"digest":{"line_hashes":["110038082440133928243647618735064586845","153942206308715827523636941930677953745","301186365577948111165377126548766545259","88692615793945068479985108822729888282"],"threshold":0.9},"id":"CVE-2026-77220-a93dae83"},{"digest":{"function_hash":"225031063541702359332826341943304795865","length":317},"id":"CVE-2026-77220-c284ece5","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/pdfio/commit/22b9afc800c5833f9e851e35938972bd4c76a357","target":{"file":"pdfio-dict.c","function":"pdfioDictSetStringf"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}