CVE-2026-54530

Analyzed Analyzed - Analysis Complete

Infinite Loop in PyPDF Text Extraction

Publication date: 2026-06-22

Last updated on: 2026-06-25

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-25

Generated

2026-07-13

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2026-54530

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.13.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Prior to version 6.13.0, an attacker can craft a specially designed PDF file that causes the library to enter an infinite loop when extracting text in layout mode.

The issue is fixed in version 6.13.0 of pypdf.

Impact Analysis

The vulnerability can cause the pypdf library to enter an infinite loop during text extraction in layout mode when processing a maliciously crafted PDF.

This can lead to denial of service conditions, such as application hangs or resource exhaustion, impacting availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the pypdf library to version 6.13.0 or later, where the issue has been fixed.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-54530 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability occurs when extracting text in layout mode from a crafted PDF using vulnerable versions of the pypdf library prior to 6.13.0, causing an infinite loop.

To detect this vulnerability on your system, you should first check the version of the pypdf library installed. If it is older than 6.13.0, your system is potentially vulnerable.

You can check the installed version of pypdf using the following command:

pip show pypdf

Alternatively, to check the version programmatically in Python:

python -c "import pypdf; print(pypdf.__version__)"

If you need to detect if a crafted PDF triggers the infinite loop, you can attempt to extract text in layout mode from suspicious PDF files using pypdf versions prior to 6.13.0 and observe if the process hangs or enters an infinite loop.

Since the vulnerability is triggered by text extraction in layout mode, monitoring for unusually long or hanging PDF processing tasks involving pypdf may also indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-54530. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70