Executive brief
The oxidize-pdf library, used for generating PDF documents in Rust, .NET, and Python, contains a flaw that allows the creation of malformed PDF files. If an application uses this library to generate PDFs based on user-provided color values, an attacker could provide specially crafted inputs that cause the resulting PDF to be rejected or crash common viewers like Adobe Acrobat or Apple Preview. This results in a denial-of-service where generated documents become unusable.
Technical details
The oxidize-pdf library defines its Color enum with public variants, allowing callers to bypass internal validation/clamping logic by directly constructing variants with non-finite f64 values (NaN, inf, -inf). When these values are serialized into a PDF content stream, the Rust standard library formats them as strings like 'NaN', which are invalid numeric tokens according to ISO 32000-1 §7.3.3. This results in malformed PDFs that conformant parsers (Adobe Acrobat, PDF.js, etc.) will reject. The vulnerability affects the core Rust library and its .NET and Python FFI bindings. A fix was implemented in version 2.6.0 by introducing a sanitization helper at the emission boundary to substitute non-finite values with 0.0.
Affected products
- bzsanti oxidize-pdf <= 2.5.7
- bzsanti OxidizePdf.NET <= 0.7.1
- bzsanti oxidize-pdf (Python) <= 0.4.3
Timeline
- 2026-05-06: advisory: Initial advisory published by bzsanti
- 2026-05-11: disclosed: GitHub Advisory Database entry created
- 2026-05-11: patched: Patched versions released for Rust, .NET, and Python packages