CVE-2026-115580 py-pdf CVE debrief

Who should care

Defenders responsible for systems processing large PDF files, especially in environments where pypdf is used, should assess exposure and verify remediation. They should prioritize upgrading to pypdf version 6.21.2 or applying workarounds. Defenders should also review compensating controls for exposed systems and monitor for large PDF files being processed in their environments.

Why it matters

CVE-2026-115580 allows an attacker to craft a PDF leading to long runtimes in pypdf. Defenders should assess exposure, verify remediation, and prioritize upgrading to pypdf version 6.21.2.

• Potential for denial-of-service (DoS) due to long runtimes
• Need for verification of pypdf version and exposure
• Priority for upgrading to pypdf version 6.21.2 or applying workarounds

Technical summary

The vulnerability in pypdf allows an attacker to craft a PDF that leads to long runtimes by opening a file with large or incorrect upper limits in the xref table. This issue has been fixed in pypdf version 6.21.2. Users unable to upgrade can apply changes from PR #4239 as a workaround. The vulnerability can cause potential denial-of-service (DoS) due to long runtimes. Defenders should prioritize assessing exposure and verifying remediation for pypdf versions prior to 6.21.2, especially in environments where large PDF files are processed.

Defensive priority

Defenders should prioritize assessing exposure and verifying remediation for pypdf versions prior to 6.21.2, especially in environments where large PDF files are processed.

Recommended defensive actions

• Assess exposure for pypdf versions prior to 6.21.2
• Verify remediation by upgrading to pypdf version 6.21.2 or applying changes from PR #4239
• Monitor for large PDF files being processed in environments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows an attacker to craft a PDF that leads to long runtimes by opening a file with large or incorrect upper limits in the xref table. This issue has been fixed in pypdf version 6.21.2. Users unable to upgrade can apply changes from PR #4239 as a workaround.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.