CVE-2026-31826: pypdf: manipulated stream length values can exhaust RAM
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream.
Patches This has been fixed in pypdf==6.8.0.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3675.
As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by open("file.pdf", mode="rb") for example. Passing a file path or a BytesIO buffer to pypdf instead does not seem to trigger the vulnerability.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31826?
CVE-2026-31826 has a high severity rating due to its potential to cause significant memory exhaustion.
How do I fix CVE-2026-31826?
To fix CVE-2026-31826, update to pypdf version 6.8.0 or later.
What type of attack does CVE-2026-31826 enable?
CVE-2026-31826 enables attackers to craft PDFs that can lead to excessive RAM usage.
Which versions of pypdf are affected by CVE-2026-31826?
Versions of pypdf prior to 6.8.0 are affected by CVE-2026-31826.
What is the impact of CVE-2026-31826?
The impact of CVE-2026-31826 is that it allows for memory exhaustion when parsing PDF content streams with manipulated length values.