CVE-2026-77220: Michaelrsweet Pdfio

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

Affected products

• Michaelrsweet Pdfio: before 1.6.5 (fixed in 1.6.5)

Published 2026-08-21. Last modified 2026-09-24.