CVE-2026-27888 py-pdf CVE debrief

Who should care

Defenders who use the pypdf library should assess their exposure and prioritize upgrading to pypdf 6.7.3 or applying the patch manually to prevent potential RAM exhaustion attacks. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-27888 is a vulnerability in the pypdf library that can lead to RAM exhaustion. Defenders should prioritize upgrading to pypdf 6.7.3 or applying the patch manually to prevent potential RAM exhaustion attacks.

• Potential RAM exhaustion attacks
• Need to verify exposure and apply patch or workaround

Technical summary

The pypdf library has a vulnerability that can lead to RAM exhaustion when accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This issue has been fixed in pypdf 6.7.3. The vulnerability has a CVSS score of 6.6 and a severity of MEDIUM. Defenders should prioritize upgrading to pypdf 6.7.3 or applying the patch manually to prevent potential RAM exhaustion attacks. The vulnerability is triggered by a specific sequence of events, and defenders should review their exposure and apply the patch or workaround.

Defensive priority

Defenders should prioritize upgrading to pypdf 6.7.3 or applying the patch manually to prevent potential RAM exhaustion attacks.

Recommended defensive actions

• Upgrade to pypdf 6.7.3 or later
• Apply the patch manually as a workaround
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The fix is available in pypdf 6.7.3. Defenders should verify exposure and apply the patch or workaround. The CVE record was published on 2026-02-26T01:16:25.470Z and has not been modified since then. The NVD vulnerability detail page provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.