Threat database

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-77220 is a high-severity vulnerability in pdfio before version 1.6.5. It involves a dangling pointer issue in the dictionary string-formatting function, where a pointer to a stack-local buffer is stored without copying the string. This can lead to cross-tenant document content corruption in multi-threaded or pooled-request environments by overwriting dictionary string values between callers.