CVE-2026-33699: pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.
Patches
This has been fixed in pypdf==6.9.2.
Workarounds
If users cannot upgrade yet, consider applying the changes from PR #3693.
Other sources
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33699?
CVE-2026-33699 is classified as a moderate severity vulnerability due to its potential to cause an infinite loop.
How do I fix CVE-2026-33699?
To fix CVE-2026-33699, you should upgrade to pypdf version 6.9.2 or later.
What impact does CVE-2026-33699 have on my system?
CVE-2026-33699 can lead to denial of service through an infinite loop when processing specially crafted PDF files in non-strict mode.
Is CVE-2026-33699 related to a specific version of pypdf?
Yes, CVE-2026-33699 affects versions of pypdf prior to 6.9.2.
Can CVE-2026-33699 be exploited remotely?
CVE-2026-33699 can be exploited remotely if an attacker provides a malicious PDF file to a vulnerable application.