PDFio before version 1.6.5 contains a dangling pointer flaw in its dictionary string‑formatting function that stores a pointer to a stack‑local buffer without copying the string value. When the stack memory is reused across requests, this can silently overwrite a preceding caller’s dictionary string values with data from another caller, resulting in cross‑tenant document content corruption. The primary impact is that an attacker or concurrent user can alter the content of another user’s PDF documents, compromising data integrity and potentially exposing sensitive information.

The vulnerability affects the PDFio library developed by Michael Sweet. All releases prior to version 1.6.5 are impacted; users deployed with these older versions are at risk in multi‑threaded or pooled request environments.

The CVSS score of 7.1 indicates a high severity of the flaw. EPSS is not available, so the exploit probability cannot be quantified at present. The issue is not listed in CISA’s KEV catalog. Because the vulnerability requires concurrent or multi‑threaded execution, the likely attack vector is a remote or local privileged user running PDFio in a multi‑user context; exploitation would rely on the memory reuse pattern and is therefore more probable in shared server environments. The flaw is exploitable without additional dependencies and can lead to integrity loss for document contents across tenants.