CyberRota Analysis
AI-GeneratedPDFio versions prior to 1.6.5 are vulnerable to a dangling pointer issue in the dictionary string-formatting function, which can lead to cross-tenant document content corruption in multi-threaded environments. This vulnerability allows attackers to exploit stack memory reuse, potentially overwriting one user's data with another's without detection. Organizations using PDFio in multi-threaded or pooled-request scenarios should prioritize patching to mitigate the risk of data integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.