CVE-2024-56520: Tecnickcom/tc lib pdf font Tecnickcom/tc-lib-pdf-font Mishandles Fonts Vulnerability
MODERATECVE-2024-56520 is a MODERATE tecnickcom/tc-lib-pdf-font mishandles fonts vulnerability (General Security Weakness) affecting Tecnickcom/tc lib pdf font libraries in the Packagist ecosystem. The issue involves tecnickcom/tc-lib-pdf-font mishandles fonts. Remediation is available by upgrading affected packages to version 2.6.4.
CVE-2024-56520 at a Glance
How to Fix CVE-2024-56520
To remediate this vulnerability, upgrade all affected Tecnickcom/tc lib pdf font dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade tecnickcom/tc-lib-pdf-font to 2.6.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for tecnickcom/tc-lib-pdf-fontHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-56520, inspect your project dependencies for Tecnickcom/tc lib pdf font:
inspect dependencies for tecnickcom/tc-lib-pdf-fontAnalyze the terminal output to locate any version of Tecnickcom/tc lib pdf font in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.6.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Tecnickcom/tc lib pdf font, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-56520 Affected Tecnickcom/tc lib pdf font Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
tecnickcom/tc-lib-pdf-font
|
Packagist |
< 2.6.4
|
2.6.4
|
References
Frequently Asked Questions
What is CVE-2024-56520?
Which Tecnickcom/tc lib pdf font versions are affected?
What version fixes CVE-2024-56520?
Is tecnickcom/tc-lib-pdf-font affected?
What CWE is associated with CVE-2024-56520?
How can I check Packagist dependencies for CVE-2024-56520?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-grhh-r4jj-8jh7",
"modified" : "2025-11-04T16:15:37Z",
"published" : "2024-12-27T06:30:47Z",
"aliases" : [ "CVE-2024-56520" ],
"summary" : "tecnickcom/tc-lib-pdf-font mishandles fonts",
"details" : "An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "tecnickcom/tc-lib-pdf-font"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.6.4"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-56520"
}, {
"type" : "WEB",
"url" : "https://github.com/tecnickcom/TCPDF/commit/a0a02efe487cc39bd5223359e916dbeafb5cd6fe"
}, {
"type" : "WEB",
"url" : "https://github.com/tecnickcom/tc-lib-pdf-font/commit/30012e333ae611c514ec2dc7cb370bbf4da4e677"
}, {
"type" : "WEB",
"url" : "https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/tecnickcom/tc-lib-pdf-font"
}, {
"type" : "WEB",
"url" : "https://github.com/tecnickcom/tc-lib-pdf-font/compare/2.6.2...2.6.4"
}, {
"type" : "WEB",
"url" : "https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html"
}, {
"type" : "WEB",
"url" : "https://tcpdf.org"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-12-27T19:53:21Z",
"nvd_published_at" : "2024-12-27T05:15:07Z"
}
}