pypdf CVE-2026-84311

The target application must call pypdf's extract_text() method or any internal path invoking PageObject._extract_text or PageObject.extract_xform_text on a PDF supplied by an attacker, using pypdf prior to 6.16.1. No authentication, elevated privilege, or non-default configuration is required on the attacker's side - only the ability to submit a PDF file for processing. What limits exploitation is entirely on the defender's side: applications that process only internally-generated or pre-validated PDFs from trusted sources are not at risk. The Form XObject mechanism exploited is a standard, always-enabled PDF feature, not an optional mode, so there is no configuration flag to disable it as a workaround.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VA:L, score 4.8) assigns local attack vector with user participation, which reflects a desktop tool usage pattern. For the more common deployment pattern - web services and data pipelines that automatically process user-uploaded PDFs - the effective attack vector is network with no meaningful user interaction required beyond a file upload, making the score a material understatement of real-world risk. No EPSS data was provided and the CVE carries no CISA KEV listing, meaning exploitation is not confirmed to be occurring. No public exploit code has been identified, though the attack primitive is straightforward for anyone with PDF format knowledge. The impact is limited to availability (CPU and memory exhaustion of the processing worker), with no confidentiality or integrity implications. Relative priority depends almost entirely on deployment context: operators running pypdf in automated, network-accessible ingestion pipelines against untrusted input should treat this as a meaningful availability risk; operators processing only trusted, internally-generated PDFs face essentially zero risk.

An attacker constructs a PDF in which a root Form XObject invokes two named child XObjects, each of which in turn invokes the same grandchild XObject twice - a structure that is fully valid per the PDF specification. Submitting this PDF to a document ingestion API or file-processing service built on pypdf causes extract_text() to enter an exponential traversal, stalling the worker process with mounting CPU and memory consumption. No public proof-of-concept exists, but the crafted PDF is trivially constructable by anyone familiar with PDF XObject syntax.