An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-56520
• tecnickcom/TCPDF@a0a02ef
• tecnickcom/tc-lib-pdf-font@30012e3
• tecnickcom/TCPDF@6.7.8...6.8.0
• tecnickcom/tc-lib-pdf-font@2.6.2...2.6.4
• https://tcpdf.org