CVE-2026-77220

Name of the Vulnerable Software and Affected Versions PDFio versions prior to 1.6.5

Description A dangling pointer issue exists in the dictionary string-formatting function. The software stores a pointer to a stack-local buffer in the document dictionary instead of copying the string value. In multi-threaded or pooled-request environments, this allows for stack memory reuse across requests, which can lead to cross-tenant document content corruption as one caller's dictionary string values are silently overwritten by another caller's data.

Recommendations Update to version 1.6.5 or later.