Executive brief
pypdf is a Python library used to extract, manipulate, and analyze PDF files. A vulnerability in how pypdf processes XForm objects (a PDF feature for reusable content) allows an attacker to craft a malicious PDF that consumes excessive memory and processing time when text is extracted. This can cause applications using pypdf to become unresponsive or crash, disrupting any service that relies on automated PDF processing.
Technical details
The vulnerability is rooted in excessive iteration (CWE-834) during XForm object extraction, specifically when handling reused XForm objects within a PDF. The vulnerable code path is triggered when an application calls text extraction on a page containing multiple or reused XForm objects. An attacker can craft a PDF with specially designed XForm structures that cause the parser to iterate far beyond necessary bounds, leading to polynomial or exponential runtime and memory exhaustion. The attack vector is local with passive user interaction (the victim must attempt to extract text from the malicious PDF). No authentication or elevated privileges are required. The fix is available in pypdf 6.16.1; users unable to upgrade may apply the patch from PR #3966.
Affected products
- py-pdf pypdf < 6.16.1
Timeline
- 2026-08-14: disclosed: GitHub Advisory published
- 2026-09-01: patched: Fix released in pypdf 6.16.1
- 2026-09-01: advisory: Public advisory updated