CVE-2026-84311: pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Compensating control
If upgrading is not yet possible, apply the changes from PR #3966.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pypdf versions earlier than 6.16.1 are exposed when they extract text from attacker-controlled or otherwise untrusted PDF files.
What must an attacker provide to trigger the resource consumption?
The attacker needs to supply a crafted PDF containing reused form XObjects arranged as a directed acyclic graph where forms invoke child forms multiple times. Triggering occurs during PageObject._extract_text or PageObject.extract_xform_text processing.
What is the impact of successful exploitation?
Text extraction can follow exponentially many traversal paths, resulting in long runtimes and large memory consumption.
How can this be remediated?
Upgrade pypdf to version 6.16.1 or later, which contains the fix.