CVE-2026-33123: pypdf has inefficient decoding of array-based streams
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.
Patches This has been fixed in pypdf==6.9.1.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3686.
Other sources
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33123?
CVE-2026-33123 has a high severity due to potential denial of service caused by long runtimes and large memory usage.
How do I fix CVE-2026-33123?
To fix CVE-2026-33123, upgrade pypdf to version 6.9.1 or later.
What type of vulnerability is CVE-2026-33123?
CVE-2026-33123 is a denial of service vulnerability caused by inefficient decoding of array-based streams in pypdf.
Who is affected by CVE-2026-33123?
Any applications using versions of pypdf prior to 6.9.1 are affected by CVE-2026-33123.
What can an attacker do with CVE-2026-33123?
An attacker can exploit CVE-2026-33123 by crafting a PDF file that triggers excessive resource consumption.