CVE-2026-102997 py-pdf CVE debrief

Who should care

Defenders responsible for systems using pypdf should assess exposure and apply the patch to prevent potential application unavailability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and apply the patch. The vulnerability can cause significant application unavailability, making it essential for defenders to take proactive measures.

Why it matters

Defenders should care about CVE-2026-102997 because it can cause significant application unavailability in pypdf, and they should verify exposure and apply the patch.

• Potential application unavailability due to inefficient decompression
• Need to verify exposure and apply patch
• Possible performance impacts on systems processing crafted PDFs

Technical summary

Prior to version 6.18.1, pypdf's inefficient byte-by-byte decompression can be triggered by a crafted PDF, leading to long runtimes and application unavailability. The issue arises from a partially malformed /FlateDecode stream with padded data. This vulnerability can cause significant application unavailability in pypdf. Defenders should verify exposure and apply the patch to prevent potential impacts. The fix is included in version 6.18.1, which addresses the residual issue after the malformed FlateDecode recovery fix.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as this issue can cause significant application unavailability.

Recommended defensive actions

• Verify if the system uses pypdf and assess exposure
• Apply the patch to upgrade to version 6.18.1 or later
• Monitor for potential application unavailability due to inefficient decompression
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while the vendor's patch notes and security advisory offer additional context. The issue is confirmed to be fixed in version 6.18.1. Defenders should verify exposure and apply the patch to prevent potential application unavailability. The vulnerability is related to inefficient byte-by-byte decompression triggered by a crafted PDF.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.