CVE-2026-27024

Received Received - Intake

Infinite Loop Vulnerability in pypdf TreeObject Handling

Publication date: 2026-02-20

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-20

Last Modified

2026-02-24

Generated

2026-07-06

AI Q&A

2026-02-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27024

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.7.1, an attacker could craft a specially designed PDF that triggers an infinite loop when the library accesses the children of a TreeObject, such as when processing outlines.

The issue is fixed in version 6.7.1 of pypdf.

Impact Analysis

Exploiting this vulnerability can cause the pypdf library to enter an infinite loop, potentially leading to denial of service conditions in applications that use this library to process PDF files.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the pypdf library to version 6.7.1 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-27024. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70