CVE-2026-28804 py-pdf CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use the pypdf library should be aware of this vulnerability and take steps to upgrade to a patched version. The vulnerability can cause long runtimes when processing PDFs, and defenders should prioritize upgrading to version 6.7.5 or later to prevent potential performance issues. Defenders should also review and update PDF processing workflows to handle potential performance issues and monitor

Why it matters

CVE-2026-28804 is a vulnerability in the pypdf library that can lead to long runtimes when processing a specially crafted PDF. Defenders should prioritize upgrading to version 6.7.5 or later to prevent potential performance issues.

• Potential performance issues when processing PDFs
• Need to upgrade to version 6.7.5 or later to prevent potential issues

Technical summary

The pypdf library is vulnerable to a performance issue that can be triggered by processing a specially crafted PDF. This issue has been patched in version 6.7.5. The vulnerability is triggered by accessing a stream which uses the /ASCIIHexDecode filter. Defenders should prioritize upgrading to version 6.7.5 or later to prevent potential performance issues. The CVE record and NVD entry provide information on the vulnerability and its patch. The vulnerability can cause long runtimes when processing PDFs, and defenders should review and update PDF processing workflows to handle potential performance issues.

Defensive priority

Defenders should prioritize upgrading to version 6.7.5 or later to prevent potential performance issues.

Recommended defensive actions

• Upgrade to pypdf version 6.7.5 or later
• Review and update PDF processing workflows to handle potential performance issues
• Monitor for and respond to potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide information on the vulnerability and its patch. The vulnerability is triggered by accessing a stream which uses the /ASCIIHexDecode filter. The issue has been patched in version 6.7.5. Defenders should verify the affected scope and severity of the vulnerability and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.