pypdf Infinite Loop Vulnerability (CVE-2026-119203)

Executive Summary

A vulnerability in pypdf can lead to an infinite loop when processing a crafted PDF file without a trailer, allowing an attacker to cause a denial-of-service (DoS). The vulnerability has a CVSS score of 7.1 and is fixed in pypdf version 6.21.4. Affected users should update to the latest version to mitigate the risk.

Technical Analysis

The vulnerability is classified as a Loop with Unreachable Exit Condition (Infinite Loop), specifically CWE-835. An attacker can craft a PDF file that leads to an infinite loop when processed by pypdf. This requires opening an incomplete file without a `trailer`. The vulnerability is triggered when the parser hits the end of the file (EOF) in the standard xref table during the trailer search.

How It Gets Exploited

An attacker would need to craft a malicious PDF file without a trailer and provide it to a victim who then attempts to open it using a vulnerable version of pypdf. When the victim tries to open the file, the parser will enter an infinite loop, causing the program to hang or consume excessive CPU resources. The attacker gains the ability to cause a denial-of-service (DoS) condition.

Impact Assessment

The vulnerability affects pypdf versions less than 6.21.4. Users of affected versions are at risk of a DoS attack. The CVSS score of 7.1 indicates a high severity level. There is no indication of active exploitation.

Recommended Actions

- Update pypdf to version 6.21.4 or later. - If immediate update is not possible, consider applying the changes from PR #4289. - Be cautious when opening PDF files from untrusted sources.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-5849-834g-hvw5