Is there a patch available for CVE-2026-41314?

Yes, a patch is available for CVE-2026-41314. Update the affected software to the latest version immediately.

pypdf CVE-2026-41314

Q: What is the CVSS score of CVE-2026-41314?

CVE-2026-41314 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25116 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-04-22 GitHub_M

Information Disclosure Python Red Hat Suse

4.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 27, 2026 - 19:29 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:07 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

CVSS changed

Apr 22, 2026 - 22:22 NVD

4.8 (MEDIUM)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25116

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:08 nvd

MEDIUM 4.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

89 pypi packages depend on pypdf (19 direct, 70 indirect)

Ecosystem-wide dependent count for version 6.10.2.

DescriptionGitHub Advisory

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

AnalysisAI

Denial of service via memory exhaustion in pypdf prior to 6.10.2 allows local attackers with user interaction to crash applications processing crafted PDF files containing FlateDecode-compressed images with inflated size values. The vulnerability exhausts available RAM during decompression, affecting any system using vulnerable pypdf versions to parse untrusted PDF documents.

Technical ContextAI

pypdf is a pure-Python PDF parsing library that processes PDF streams, including compressed image data. The vulnerability resides in the FlateDecode decompression handler, which implements zlib-based deflate decompression commonly used in PDF for image and content stream compression. The root cause is CWE-789 (memory allocation with excessive size values), where the library fails to validate or limit the declared uncompressed size of image objects before allocating memory or decompressing them. An attacker crafts a PDF with an image object specifying a /FlateDecode filter and artificially large Width/Height or other dimension parameters, causing the decompression routine to allocate and consume excessive RAM until the system runs out of memory. The CPE cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:* identifies all pypdf distributions prior to version 6.10.2 as affected.

RemediationAI

Upgrade pypdf to version 6.10.2 or later, which includes the fix available in GitHub commit ac734dab4eef92bcce50d503949b4d9887d89f11. For Python environments, run 'pip install --upgrade pypdf>=6.10.2'. As an interim workaround for applications unable to upgrade immediately, manually apply the patch from the GitHub pull request (https://github.com/py-pdf/pypdf/pull/3734), which adds size validation to the FlateDecode decompression handler. Additionally, restrict pypdf's access to untrusted PDFs by implementing file validation (e.g., reject PDFs from unknown sources), running pypdf in resource-limited containers with enforced memory quotas, or using a sandboxed process to parse externally sourced documents with a timeout mechanism. Each mitigation has trade-offs: manual patching requires code review and testing; resource limits may affect legitimate large-document processing; sandboxing adds latency.