CVE-2026-27888: pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode.
Patches This has been fixed in pypdf==6.7.3.
Workarounds If projects cannot upgrade yet, consider applying the changes from PR #3658.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.7.3 - Compensating control
Avoid accessing the 'xfa' property on pypdf Reader or Writer when processing untrusted PDFs (the issue is triggered when the XFA stream is compressed with /FlateDecode). Reject, sandbox, or otherwise isolate PDFs that contain FlateDecode-compressed XFA streams until the patch or fixed version is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27888?
CVE-2026-27888 is a significant vulnerability that can lead to exhaustion of RAM when malicious XFA streams are manipulated.
How do I fix CVE-2026-27888?
To fix CVE-2026-27888, upgrade the pypdf package to version 6.7.3 or later.
What software is affected by CVE-2026-27888?
CVE-2026-27888 affects all versions of the pypdf package prior to version 6.7.3.
What type of attack does CVE-2026-27888 enable?
CVE-2026-27888 enables an attacker to craft PDF files that can exhaust memory resources on the affected system.
How does CVE-2026-27888 exploit memory resources?
CVE-2026-27888 exploits memory resources by manipulating the xfa property of a reader or writer with FlateDecode compressed streams.