CVE-2026-77220 PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
Attackers can corrupt document data or read sensitive information by exploiting a dangling pointer in PDFio's dictionary string formatting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77220?
CVE-2026-77220 is a high-severity use after free vulnerability in michaelrsweet pdfio, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.
Weakness: CWE-825
Which versions are affected by CVE-2026-77220?
How do I fix CVE-2026-77220?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-77220 being exploited?
There is no known exploitation of CVE-2026-77220 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-77220, GHSA-2fr4-jfvm-chmp, UBUNTU-CVE-2026-77220.