CVE-2026-28351: Manipulated RunLengthDecode streams can exhaust RAM
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.
Patches This has been fixed in pypdf==6.7.4.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3664.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28351?
CVE-2026-28351 has a severity level that can lead to significant memory exhaustion due to manipulated RunLengthDecode streams.
How do I fix CVE-2026-28351?
To fix CVE-2026-28351, update to pypdf version 6.7.4 or later.
What software is affected by CVE-2026-28351?
CVE-2026-28351 affects pypdf versions prior to 6.7.4.
What type of attacks can exploit CVE-2026-28351?
CVE-2026-28351 can be exploited through crafted PDFs that lead to excessive memory usage.
What vulnerability does CVE-2026-28351 address?
CVE-2026-28351 addresses a vulnerability in the pypdf library where manipulated RunLengthDecode streams can cause RAM exhaustion.