Skip to main content

PDFio EUVDEUVD-2026-64163

| CVE-2026-77220 HIGH
Expired Pointer Dereference (CWE-825)
2026-08-21 VulnCheck GHSA-2fr4-jfvm-chmp
Information Disclosure Pdfio
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-exploitable in multi-threaded deployments requiring low-privilege access; no confidentiality or availability impact, high integrity impact from silent cross-tenant dictionary string corruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 21, 2026 - 21:35 vuln.today
Analysis Generated
Aug 21, 2026 - 21:35 vuln.today
CVE Published
Aug 21, 2026 - 20:54 cve.org
HIGH 7.1

DescriptionCVE.org

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

AnalysisAI

Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in pdfioDictSetStringf, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to PDF-processing service
Delivery
Submit high-concurrency PDF requests
Exploit
Trigger parallel calls to pdfioDictSetStringf
Execution
Stack frame reclaimed and reused by concurrent thread
Persist
Dangling pointer reflects second caller's string data
Impact
Victim caller's document dictionary silently corrupted
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target application to invoke PDFio in a multi-threaded or pooled-request execution environment where concurrent calls to `pdfioDictSetStringf` operate within the same process address space, allowing stack frame addresses to be reused across threads. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:N/VI:H/VA:N) characterizes a network-exploitable, low-privilege integrity violation with no user interaction required, contingent on the application exposing PDFio operations over a network interface in a concurrent processing model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged authenticated user submits a burst of concurrent PDF processing requests to a multi-threaded web service built on PDFio prior to v1.6.5. As one thread's `pdfioDictSetStringf` stack frame is reclaimed and reused by a second thread's call, the second thread's formatted string data silently overwrites the pointer stored in the first thread's document dictionary. …
Remediation Upgrade PDFio to version 1.6.5 or later, available from the official GitHub release at https://github.com/michaelrsweet/pdfio/releases/tag/v1.6.5; applications that vendor PDFio as a bundled dependency must rebuild against the updated library using the patch commit 22b9afc800c5833f9e851e35938972bd4c76a357. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems and applications using PDFio and determine which are operating in multi-threaded or request-pooled configurations where cross-tenant isolation is required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pdfio

View all
CVE-2023-24808 MEDIUM POC
6.5 Feb 07

PDFio is a C library for reading and writing PDF files. Rated medium severity (CVSS 6.5), this vulnerability is remotely
CVE-2024-42358 MEDIUM POC
5.5 Aug 06

PDFio is a simple C library for reading and writing PDF files. Rated medium severity (CVSS 5.5), this vulnerability is n
CVE-2023-28428 LOW
3.3 Mar 20

PDFio is a C library for reading and writing PDF files. Rated low severity (CVSS 3.3), this vulnerability is no authenti

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-64163 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy