Description

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T21:17:06.737Z",
  "pubdate": "2026-08-21T21:17:06.737Z",
  "executiveSummary": "PDFio before version 1.6.5 suffers from a dangling pointer vulnerability within its dictionary string-formatting function. The flaw stems from the insecure handling of string references, where a pointer to a stack-local buffer is stored directly inside the document dictionary without performing a deep copy of the underlying string value.\nThe primary impact of this vulnerability is cross-tenant document content corruption and potential information disclosure. In multi-threaded environments or thread-pooled execution models, concurrent users or distinct request handlers can trigger stack memory reuse across execution contexts. As stack frames are overwritten by subsequent function calls, the dangling pointer retained in the document dictionary silently references mutated memory locations, corrupting one caller's dictionary string values with arbitrary data originating from another caller.\nThis vulnerability poses a significant risk to applications processing untrusted or concurrent PDF generation workloads, particularly in multi-tenant SaaS platforms where data isolation between distinct execution contexts is critical. Exploitation does not necessarily require direct malicious interaction if natural concurrency and stack reuse trigger the memory corruption condition, although an attacker capable of controlling request timing and payload sizes could theoretically induce predictable memory reuse patterns to manipulate document structures or extract sensitive memory residues.",
  "technicalDetails": "The root cause of the vulnerability resides in the dictionary string-formatting function of PDFio before version 1.6.5. During the construction or formatting of dictionary entries, the application logic generates a string representation residing on the local stack frame. Rather than allocating heap memory and copying the string value into a persistent buffer owned by the document dictionary structure, the function stores a raw memory reference pointing directly to the stack-local variable.\nBecause the reference targets stack memory, its validity is strictly bound to the lifespan of the stack frame in which it was created. Once the formatting function returns, the stack frame is marked as reusable. In single-threaded synchronous execution models, this memory might be overwritten promptly by subsequent function prologues without immediate catastrophic failure. However, in modern multi-threaded architectures or thread-pooled request handlers, different threads or sequential requests allocated to the same thread rapidly reuse identical stack regions.\nThe step-by-step attack flow proceeds as follows: First, Caller A initiates a request that invokes the vulnerable PDFio dictionary string-formatting function. A string is formatted, placed on the stack, and its stack address is improperly stored inside the document dictionary pointer without duplication. Second, before Caller A serializes or finishes processing the document dictionary, the execution context terminates or yields. Third, Caller B initiates a concurrent or subsequent request that executes unrelated functions, allocating stack memory over the exact same physical addresses previously occupied by Caller A's stack frame. Fourth, Caller B writes arbitrary data into this stack space, which overwrites the memory now pointed to by Caller A's document dictionary.\nWhen Caller A subsequently accesses or serializes the document dictionary, the application dereferences the dangling pointer, retrieving Caller B's data instead of the original string value. This results in silent cross-tenant document content corruption. The affected component is the dictionary handling and string-formatting subsystem of PDFio versions prior to 1.6.5. The vulnerability manifests without requiring authentication or specific privileges, relying solely on the concurrent processing of requests within an application utilizing the vulnerable library in a multi-threaded or pooled environment."
}