SB2026110662 - Multiple vulnerabilities in PyPDF

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110662

SB2026110662 - Multiple vulnerabilities in PyPDF

Published: November 6, 2026 Updated: November 8, 2026

Security Bulletin ID SB2026110662
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to cause excessive memory usage in applications processing PDF images with pypdf.

The vulnerability exists due to uncontrolled memory consumption in pypdf image processing when loading images that require operations such as conversion to another color space. An attacker can craft a PDF containing such images and trigger large memory usage when an application loads and processes those images.


2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to guess sensitive placeholder values in encrypted documents created from templates.

The vulnerability exists due to information exposed through pypdf file identifiers for encrypted templated documents. An attacker can use a document with the same template and access to other documents' file identifiers to guess placeholder values without decrypting the target documents.


3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to cause large memory consumption when pypdf loads images from a crafted PDF.

The vulnerability exists due to missing data size limits in certain image filters used by pypdf during image loading. An unauthenticated attacker can craft a PDF containing images that use these filters and trigger excessive memory allocation when an application loads those images.


4) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to cause large memory usage in applications that parse PDFs using pypdf.

The vulnerability exists due to inefficient processing of cross-reference streams in pypdf when multiple offsets point to the same large object. An unauthenticated attacker can craft a PDF containing these identical offsets and trigger excessive memory consumption when an application parses the file.


5) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to cause excessive memory consumption in applications that use pypdf to load XFA forms from a crafted PDF.

The vulnerability exists due to uncontrolled resource consumption in pypdf's XFA form handling when loading forms containing many fields. An attacker can craft a PDF with numerous XFA fields, including small fields, that consumes large amounts of memory when those forms are loaded.


Remediation

Install update from vendor's website.

References