Vulnerability · Published Aug 21, 2026 · Assigned by VulnCheck

CVE-2026-77220PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

Medium 6.5

In plain English

A medium-severity security flaw in pdfio from michaelrsweet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ippsample	no fix listed	DEBIAN-CVE-2026-77220
Debian:14	ippsample	no fix listed	DEBIAN-CVE-2026-77220
Debian:14	pdfio	1.6.5+dfsg-1	DEBIAN-CVE-2026-77220
Ubuntu:22.04:LTS	ippsample	no fix listed	UBUNTU-CVE-2026-77220
Ubuntu:24.04:LTS	ippsample	no fix listed	UBUNTU-CVE-2026-77220
Ubuntu:26.04:LTS	ippsample	no fix listed	UBUNTU-CVE-2026-77220
Ubuntu:26.10	ippsample	no fix listed	UBUNTU-CVE-2026-77220

Affected products (as reported)

Vendor	Product	Versions
michaelrsweet	pdfio	0 – before 1.6.5

Weakness: CWE-825 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/pdfio-dangling-pointer-via-dictionary-string-formatting third-party-advisory