Resource exhaustion in PyPDF - #VU159659
Published: November 6, 2026
Vulnerability identifier: #VU159659
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to cause excessive memory usage in applications processing PDF images with pypdf.
The vulnerability exists due to uncontrolled memory consumption in pypdf image processing when loading images that require operations such as conversion to another color space. An attacker can craft a PDF containing such images and trigger large memory usage when an application loads and processes those images.
Affected software
PyPDF
Remediation
Install security update from vendor's website.
PyPDF - update to 7.0.0