CVE-2026-77220: Expired Pointer Dereference in michaelrsweet pdfio

The vulnerability in michaelrsweet pdfio versions prior to 1.6.5 arises from the dictionary string-formatting function storing a pointer to a stack-local buffer in the document dictionary without copying the string value. In environments with concurrent or multi-threaded requests, this dangling pointer can cause stack memory reuse across requests, resulting in silent overwriting of one caller's dictionary string values with another's data. This leads to cross-tenant document content corruption.

Exploitation of this vulnerability can cause corruption of document content across tenants or users in multi-threaded or pooled-request environments. This undermines data integrity by allowing one user's dictionary string values to be silently overwritten by another's, potentially causing confusion or data leakage. There is no indication of privilege escalation, denial of service, or remote code execution from the provided data.

A fix is available in pdfio version 1.6.5 and later. Users should upgrade to version 1.6.5 or newer to remediate this vulnerability. No additional mitigation guidance is provided or required based on the vendor advisory data.