Quick answers
- Is CVE-2026-27628 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-27628 being exploited in the wild.
- How severe is CVE-2026-27628?
- High severity, with a CVSS score of 7.5, published 25 February 2026.
- Which products and versions are affected?
- pypdf (PyPI) ECOSYSTEM:introduced=0,fixed=6.7.2.
- Is there a fix for CVE-2026-27628?
- Yes. pypdf (PyPI): upgrade to 6.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-27628 attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected by CVE-2026-27628?
- Check whether you run Py-Pdf Pypdf or pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pypdf (PyPI): upgrade to 6.7.2 or later
pip install "pypdf>=6.7.2"
Technical details
The vulnerability is a classic infinite loop (CWE-835) triggered by circular /Prev entries in PDF cross-reference streams. When pypdf parses a PDF file, it follows the /Prev chain in the xref stream to reconstruct document history; a circular reference causes this chain-following logic to loop indefinitely. The attack vector is network/local file access: an attacker must craft a malicious PDF and trick a user or system into opening it. The vulnerability affects all versions prior to 6.7.2 and has been patched in that release.
Affected products
- py-pdf pypdf before 6.7.2
Identifiers
- CVE-2026-27628
- GHSA-2rw7-x74f-jg35
- PYSEC-2026-3005
Timeline
- 2026-02-22: disclosed: Advisory published on GitHub
- 2026-02-25: patched: Fix released in pypdf 6.7.2