CVE-2026-119203 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using the pypdf library should assess exposure and prioritize upgrading to version 6.21.4 or applying the changes from PR #4289. This includes reviewing and updating affected systems and dependencies, as well as verifying that compensating controls are in place for exposed systems. Security teams should also monitor for potential denial-of-service attacks and review logs for exposed assets.

Why it matters

CVE-2026-119203 is a vulnerability in the pypdf library that can cause an infinite loop when processing a specially crafted PDF file without a trailer. Defenders should prioritize upgrading to pypdf version 6.21.4 or applying the changes from PR #4289 to prevent potential denial-of-service attacks.

• Potential denial-of-service attacks
• System crashes or freezes due to infinite loops
• Increased resource utilization due to processing malicious PDF files

Technical summary

The pypdf library is vulnerable to an infinite loop when processing a specially crafted PDF file without a trailer. This can cause a denial-of-service attack. The vulnerability is triggered when the library encounters an incomplete file without a trailer. Defenders should prioritize upgrading to pypdf version 6.21.4 or applying the changes from PR #4289 to prevent potential denial-of-service attacks. The issue is fixed in version 6.21.4 of the library, which should be applied to affected systems as soon as possible.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.21.4 or applying the changes from PR #4289 to prevent potential denial-of-service attacks.

Recommended defensive actions

• Upgrade to pypdf version 6.21.4
• Apply changes from PR #4289 as a workaround
• Review and update affected systems and dependencies
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by an infinite loop when hitting EOF in the standard xref table during trailer search. This requires opening an incomplete file without a trailer. The issue has been fixed in pypdf version 6.21.4. Users should verify affected systems and apply the patch or workaround accordingly. Evidence is based on the CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.