CVE-2026-54531: pypdf: Possible infinite loop when processing outlines/bookmarks in writer
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.
Patches
This has been fixed in pypdf==6.13.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3830.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.13.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.13.0 - Compensating control
If you cannot upgrade yet, apply the workaround changes from PR [#3830] (py-pdf/pypdf pull request 3830)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54531?
CVE-2026-54531 has been rated with a severity score of 20.
What type of attack does CVE-2026-54531 enable?
CVE-2026-54531 allows an attacker to craft a PDF that can lead to an infinite loop when merging files.
How do I fix CVE-2026-54531?
To fix CVE-2026-54531, upgrade to pypdf version 6.13.0 or higher.
What should I do if I cannot upgrade to fix CVE-2026-54531?
If you cannot upgrade, you should implement workarounds to prevent merging files with outlines temporarily.
When was CVE-2026-54531 published?
CVE-2026-54531 was published on June 16, 2026.