CVE-2026-41314: pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41314?
CVE-2026-41314 has a high severity rating due to its potential to exhaust system RAM.
How do I fix CVE-2026-41314?
To fix CVE-2026-41314, upgrade to pypdf version 6.10.2 or later.
What causes CVE-2026-41314?
CVE-2026-41314 is caused by manipulated FlateDecode image dimensions in PDF files that lead to RAM exhaustion.
Which versions of pypdf are affected by CVE-2026-41314?
Versions of pypdf prior to 6.10.2 are affected by CVE-2026-41314.
Can CVE-2026-41314 be exploited remotely?
Yes, CVE-2026-41314 can be exploited remotely if a user opens a maliciously crafted PDF.