CVE-2024-56520

What it actually does

Improper parsing of FontBBox data for Type 1 and TrueType fonts allows malformed font input to bypass expected validation checks during PDF generation.

Why it matters to the business

Applications that generate or process PDFs may experience unexpected behavior or partial data exposure when handling attacker-supplied fonts, increasing risk in document workflows that rely on this library.

How an attack unfolds

An attacker crafts a font file containing invalid FontBBox values, supplies it to an application using the vulnerable TCPDF or tc-lib-pdf-font code, and triggers misparsing that leads to incorrect font metrics being used in the resulting PDF.

How to fix it

Upgrade tecnickcom/tcpdf to the commit 14ffa0e308f5634aa2489568b4b90b24073b6731 or later equivalent release that incorporates tc-lib-pdf-font 2.6.4 or newer. Verify the update resolves the FontBBox parsing logic.

How to confirm the fix worked

Confirm the installed version is at or above the fixed commit, then test PDF generation using sample Type 1 and TrueType fonts that previously triggered misparsing to ensure correct FontBBox handling.

Typical attack path

1. Identify an application endpoint or feature that accepts or processes custom fonts via TCPDF.
2. Prepare a Type 1 or TrueType font with deliberately malformed FontBBox data.
3. Deliver the malicious font through file upload, configuration, or document template.
4. Trigger PDF rendering or generation to cause the library to misparse the font.
5. Observe or leverage resulting incorrect output or side effects in the generated PDF.

How to detect it

Search application and web server logs for PDF generation requests that reference unusual or externally supplied fonts, and examine any error logs related to font parsing failures around the time of document creation.

What your security team should do

• Prioritize upgrade of all instances of tecnickcom/tcpdf to the fixed commit within standard change windows.
• Review and restrict any user-supplied font handling paths until the update is deployed.
• Add the library to the vulnerability management inventory for ongoing monitoring of PDF-related dependencies.