Inefficient Algorithmic Complexity in PyPDF - #VU161873
Published: November 8, 2026
Vulnerability identifier: #VU161873
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to cause large memory usage in applications that parse PDFs using pypdf.
The vulnerability exists due to inefficient processing of cross-reference streams in pypdf when multiple offsets point to the same large object. An unauthenticated attacker can craft a PDF containing these identical offsets and trigger excessive memory consumption when an application parses the file.
Affected software
PyPDF
Remediation
Install security update from vendor's website.
PyPDF - update to 7.0.0