CVE-2026-84309
Received Received - Intake

Heap Overflow in pypdf Due to Cyclic Tree Structure

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84309
EUVD
EUVD-2026-69477

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
py_pdf pypdf 6.16.0
py_pdf pypdf to 6.16.0 (exc)
py-pdf pypdf to 6.16.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the pypdf library versions before 6.16.0. An attacker can create a malicious PDF with a cyclic tree structure that causes the TreeObject.insert_child method to enter an infinite loop when processing the file. This leads to excessive resource consumption and potential denial-of-service conditions.

Detection Guidance

To detect this vulnerability, check if your system uses pypdf versions before 6.16.0. Run: pip show pypdf. If the version is less than 6.16.0, the system is vulnerable. Additionally, monitor for unexpected high CPU usage or crashes when processing PDF files, which may indicate an infinite loop caused by malicious PDFs.

Impact Analysis

If you use a vulnerable version of pypdf to process PDF files, an attacker could send you a specially crafted PDF that triggers an infinite loop. This could cause your application to hang or crash, consuming excessive CPU and memory resources. Systems processing many PDFs automatically are particularly at risk.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service conditions through infinite loops in PDF processing. Such disruptions may lead to service unavailability, which could violate availability requirements in these regulations. However, the primary impact is operational rather than direct data exposure or privacy violation.

Mitigation Strategies

Upgrade pypdf to version 6.16.0 or later immediately using: pip install --upgrade pypdf. If immediate upgrade is not possible, apply the changes from pull request #3964 as a temporary workaround. Avoid processing untrusted PDF files until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84309. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart