CVE-2026-54530: pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.
Patches
This has been fixed in pypdf==6.13.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3830.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.13.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.13.0 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3830] for pypdf to address the infinite loop in layout-mode text extraction when retrieving fonts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54530?
CVE-2026-54530 has a risk score of 22, indicating a significant security concern.
What impact does CVE-2026-54530 have on users?
CVE-2026-54530 allows an attacker to craft a PDF that can lead to an infinite loop during text extraction in layout mode.
How do I fix CVE-2026-54530?
To fix CVE-2026-54530, upgrade to pypdf version 6.13.0 or later.
Are there any workarounds for CVE-2026-54530 if I cannot upgrade?
If you cannot upgrade from pypdf, it is recommended to avoid extracting text in layout mode as a temporary workaround.
When was CVE-2026-54530 published?
CVE-2026-54530 was published on June 16, 2026.