Allocation of Resources Without Limits or Throttling in PyPDF - #VU165943
Published: November 11, 2026
Vulnerability identifier: #VU165943
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption, potentially resulting in denial of service.
The vulnerability exists due to insufficient resource allocation limits in pypdf image loading when processing images with filters that lack data size limits. A remote attacker can craft a PDF containing such images to trigger excessive memory usage when the images are loaded.
Affected software
PyPDF
Remediation
Install security update from vendor's website.
PyPDF - update to 7.0.1