CVE-2026-33123

Published: Mar 20, 2026Modified: Jun 17, 2026

5.1

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.

Affected (1)

Products: Pypdf Project: Pypdf

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pypdf Project Pypdf	Before 6.9.1

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (3)

https://github.com/py-pdf/pypdf/pull/3686

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/py-pdf/pypdf/releases/tag/6.9.1

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.