Pdfio
Monthly
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
PDFio is a simple C library for reading and writing PDF files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
PDFio is a C library for reading and writing PDF files. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
PDFio is a C library for reading and writing PDF files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
PDFio is a simple C library for reading and writing PDF files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
PDFio is a C library for reading and writing PDF files. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
PDFio is a C library for reading and writing PDF files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.