CVE-2026-77220

This is a cross-tenant data contamination vulnerability, not merely a reliability bug. The vulnerability lives in PDFio's dictionary string-formatting function, which stores a pointer to stack-local buffer memory as a document handle. In single-threaded or sequential-request processing, this pointer remains valid. In pooled environments — which represent the overwhelming majority of production deployments — the stack memory gets reused by subsequent requests while the stored pointer persists. The result: one tenant's processed document can contain string values pulled from another tenant's request stack. This is not theoretical. The CVSS 6.5 rating is dangerous because it measures crash potential, and this vulnerability doesn't crash — it silently corrupts data in a way that leaves no forensic trace. Crash-based vulnerabilities get detected. Cross-tenant memory contamination does not. The 'medium' rating creates institutional permission to defer. Security teams triaging CVSS 6.5 findings typically schedule them for next sprint or next release cycle. In library dependencies, median time-to-remediation runs 90-120 days. Every unremediated day, more tenant documents accumulate that were processed during the exploitation window — the contamination propagates forward through every document that touches the affected instance. At disclosure, you have a contained blast radius. At the 90-day mark, you have months of potentially corrupted outputs distributed across tenants with no reliable way to identify which ones. What to do now: First, determine whether PDFio is in your dependency tree and how it's being used. If it's processing documents in any pooled or multi-tenant configuration, treat this as a priority patch regardless of the CVSS score. Second, audit the entire PDFio surface for similar patterns — functions that store pointers across request boundaries, particularly in dictionary or string-handling code. The testing blind spot here is critical: unit tests validate against specifications, and specifications encode assumptions. If the test suite assumes single-request semantics, passing tests are evidence the code correctly implements behavior that is dangerous in concurrent deployments. Third, if you've already deployed an unpatched version in a multi-tenant environment, assume cross-tenant contamination has occurred and prioritize log review for document processing anomalies — though be aware that silent corruption may not produce any logs at all. The blast radius of this vulnerability scales with every day it remains unpatched in a live environment.

Reviewed through automated stages and approved by a human before publication.