Uncontrolled Memory Allocation in PyPDF - CVE-2026-41312
Published: April 15, 2026
Vulnerability identifier: #VU126251
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41312
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in the FlateDecode stream processing logic when processing a PDF stream compressed using /FlateDecode with a /Predictor value other than 1 and large predictor parameters. A remote attacker can supply a specially crafted PDF to cause a denial of service.
Exploitation requires the application to access the crafted compressed stream.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-41312
Install security update from vendor's website.
PyPDF - update to 6.10.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2