EUVD-2026-42343
GHSA-5qjq-93h5-hrgp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered PDF, no auth or interaction needed; availability impact is low (memory exhaustion, not guaranteed crash); no confidentiality or integrity impact per description.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.
AnalysisAI
Uncontrolled memory allocation in pypdf prior to 6.14.0 allows remote, unauthenticated attackers to exhaust host memory by submitting a crafted PDF containing image metadata with inflated declared sizes that vastly exceed the actual embedded image data. Any application that uses pypdf to parse untrusted PDFs is exposed; the library allocates memory proportional to the declared (attacker-controlled) size rather than the actual data length. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
pypdf (CPE: cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*) is a pure-Python library for reading, writing, and transforming PDF documents. The root cause is CWE-789 (Uncontrolled Memory Allocation): during image parsing, the library trusts the declared image dimension or buffer size values embedded in the PDF structure rather than bounding allocation against the actual compressed data size present in the stream. PDF image objects can declare arbitrary width/height or buffer-length values independently of the actual payload, and pypdf honored those declarations without validation, leading to allocation of arbitrarily large memory regions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special attack prerequisites beyond delivering a malformed PDF to a parsing endpoint.
RemediationAI
Upgrade pypdf to version 6.14.0 or later, which is the vendor-released patch addressing this issue (https://github.com/py-pdf/pypdf/releases/tag/6.14.0). The underlying fix is available in commit c64583be16b8e8763d8777075f8ecbf382014b7a and pull request #3888 (https://github.com/py-pdf/pypdf/pull/3888). If an immediate upgrade is not feasible, apply resource controls at the application layer: restrict the maximum file size of PDFs accepted for parsing, enforce per-request memory limits using Python resource limits or container cgroup controls, and run the parsing process in an isolated worker with a memory cap so that exhaustion kills only the worker rather than the host application. These workarounds add operational overhead and do not address the root cause; upgrade to 6.14.0 as soon as practicable.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today