Memory Drain Vulnerability in pypdf by Python Software Foundation

CVE-2026-119208

What is CVE-2026-119208?

pypdf, a widely used open-source PDF library, has a vulnerability that allows an attacker to exploit crafted encrypted PDF files. By manipulating the /Count value in a PDF's page tree, the library can be tricked into consuming excessive memory and processing time when an application attempts to access the page count. Instead of properly validating the page data structure, pypdf relies on the declared count, which can lead to significant performance degradation. This issue has been addressed and resolved in version 6.21.3.

References