CVE-2026-84311: pypdf: Possible long runtimes/large memory usage when extracting XForm objects
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.16.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pypdf versions earlier than 6.16.1 are exposed when they extract text from attacker-controlled or otherwise untrusted PDF files.
What must an attacker provide to trigger the resource consumption?
The attacker needs to supply a crafted PDF containing reused form XObjects arranged as a directed acyclic graph where forms invoke child forms multiple times. Triggering occurs during PageObject._extract_text or PageObject.extract_xform_text processing.
What is the impact of successful exploitation?
Text extraction can follow exponentially many traversal paths, resulting in long runtimes and large memory consumption.
How can this be remediated?
Upgrade pypdf to version 6.16.1 or later, which contains the fix.