Executive brief
pypdf is a Python library for reading and writing PDF files. A specially crafted PDF file can trigger an infinite loop when the application processes the document's outlines (bookmarks), causing the application to hang and become unresponsive. This can lead to denial of service if untrusted PDF files are processed.
Technical details
This vulnerability is a classic infinite loop condition (CWE-835) in pypdf's outline/bookmark processing logic. An attacker can craft a malicious PDF file with a circular or self-referential outline structure that causes the parsing code to enter an unreachable exit condition. The attack vector is local or network-based depending on how the PDF is obtained, and requires only that the application process the outlines/bookmarks of the PDF file—no authentication is needed. Successful exploitation causes a denial of service through resource exhaustion (CPU/process hang). The vulnerability is fixed in pypdf version 6.6.2 and later.
Affected products
- pypdf pypdf before 6.6.2
Timeline
- 2026-01-26: disclosed
- 2026-01-26: patched: Fixed in version 6.6.2