CVE-2026-27628: pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.
Patches
This has been fixed in pypdf==6.7.2.
Workarounds
If users cannot upgrade yet, consider applying the changes from PR #3655.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27628?
The severity of CVE-2026-27628 is considered to be high due to the infinite loop caused by malformed PDF files.
How do I fix CVE-2026-27628?
To fix CVE-2026-27628, update pypdf to version 6.7.2 or later.
What software is affected by CVE-2026-27628?
CVE-2026-27628 affects pypdf versions prior to 6.7.2.
What is the exploit potential of CVE-2026-27628?
The exploit potential of CVE-2026-27628 allows an attacker to create a crafted PDF that triggers an infinite loop, affecting application performance.
Can CVE-2026-27628 affect all applications using pypdf?
Yes, any application utilizing pypdf versions prior to 6.7.2 is susceptible to CVE-2026-27628.