PDFio CVE-2026-77220

Exploitation requires the target application to invoke PDFio in a multi-threaded or pooled-request execution environment where concurrent calls to pdfioDictSetStringf operate within the same process address space, allowing stack frame addresses to be reused across threads. Per the CVSS 4.0 vector (PR:L), a low-privileged authenticated user must be able to submit PDF processing requests that are handled concurrently with other users' requests. Single-threaded deployments, or deployments that fork a separate process per request (e.g., CGI-style isolation), are not exploitable because the dangling pointer race requires concurrent stack reuse within a single shared process. Exploitation is further limited to applications that specifically exercise the pdfioDictSetStringf code path; applications that write only static (non-formatted) dictionary strings are not affected by this particular function.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:N/VI:H/VA:N) characterizes a network-exploitable, low-privilege integrity violation with no user interaction required, contingent on the application exposing PDFio operations over a network interface in a concurrent processing model. The primary risk scenario is multi-tenant document processing services - PDF conversion APIs, document management platforms, or shared print spoolers - where concurrent callers share the same process memory space and PDFio's stack frames can interleave. The absence of a CISA KEV listing and the lack of identified public exploit code substantially reduce immediate urgency for single-threaded or process-isolated deployments, where the dangling-pointer race cannot be triggered. A mild data conflict exists between the 'Information Disclosure' intelligence tag and the CVSS 4.0 VC:N metric: while a victim caller's document dictionary could receive another caller's string data (which may itself be sensitive), the primary characterized impact is integrity corruption of the victim's output rather than attacker-controlled data exfiltration. EPSS data was not available in the provided intelligence sources, so numerical exploitation probability cannot be assessed; given the low-prevalence library and the specific multi-threaded deployment requirement, real-world exploitation is likely opportunistic rather than widespread.

A low-privileged authenticated user submits a burst of concurrent PDF processing requests to a multi-threaded web service built on PDFio prior to v1.6.5. As one thread's pdfioDictSetStringf stack frame is reclaimed and reused by a second thread's call, the second thread's formatted string data silently overwrites the pointer stored in the first thread's document dictionary. The first caller receives a response PDF with metadata or content strings covertly replaced by a different user's data, with no exception or error signal emitted by the library.