CVE-2026-41314 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using the pypdf library should assess exposure and prioritize patching to version 6.10.2 or applying the workaround from the patch manually.

Why it matters

CVE-2026-41314 is a vulnerability in the pypdf library that can lead to RAM exhaustion when processing a specially crafted PDF. Defenders responsible for systems and applications using the pypdf library should assess exposure and prioritize patching to version 6.10.2 or applying the workaround from the patch manually. The vulnerability requires verification of affected versions and remediation priority.

• Potential RAM exhaustion leading to denial of service
• Requires verification of affected versions and remediation priority
• Defenders should review and update inventory to ensure affected versions are identified and remediated

Technical summary

The pypdf library is vulnerable to RAM exhaustion when processing a specially crafted PDF. An attacker can craft a PDF that leads to the RAM being exhausted by accessing an image using `/FlateDecode` with large size values. This vulnerability is present in versions prior to 6.10.2 and has been fixed in version 6.10.2. Defenders should prioritize patching to version 6.10.2 or applying the workaround from the patch manually. The vulnerability requires verification of affected versions and remediation priority. Defenders should review and update inventory to ensure affected versions are identified and remediated.

Defensive priority

Defenders should prioritize patching to version 6.10.2 or applying the workaround from the patch manually.

Recommended defensive actions

• Patch to version 6.10.2
• Apply the workaround from the patch manually
• Review and update inventory to ensure affected versions are identified and remediated
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The patch and workaround are available in the source references. The CVE record was published on 2026-04-22T22:16:32.367Z and has not been modified since then. The NVD vulnerability detail page provides additional information on the vulnerability. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.