Executive brief
A vulnerability in the pypdf library, which is used to process PDF files in Python applications, can allow an attacker to cause excessive memory consumption. By providing a specially crafted PDF with misleading image dimensions, an attacker can potentially crash the application or slow down the server, leading to a denial of service. This could impact business operations by making PDF-processing services unavailable to legitimate users.
Technical details
The pypdf library is vulnerable to a Denial of Service (DoS) via excessive memory allocation (CWE-789). The issue occurs when the library processes images within a PDF where the declared metadata dimensions are significantly larger than the actual image data provided. An attacker can exploit this by submitting a crafted PDF file over the network, requiring no specific privileges or user interaction. When the library attempts to allocate memory based on these inflated dimensions, it can lead to resource exhaustion. This vulnerability is fixed in version 6.14.0.
Affected products
- py-pdf pypdf < 6.14.0
Timeline
- 2026-06-22: disclosed
- 2026-07-08: advisory: NVD publication date
- 2026-07-23: patched: GitHub Advisory published/updated