CVE-2026-84309

Analyzed Analyzed - Analysis Complete

Heap Overflow in pypdf Due to Cyclic Tree Structure

Publication date: 2026-09-01

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-10-05

Generated

2026-10-12

AI Q&A

2026-09-01

EPSS Evaluated

2026-10-10

NVD

CVE-2026-84309

EUVD

EUVD-2026-69477

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.16.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability affects the pypdf library versions before 6.16.0. An attacker can create a malicious PDF with a cyclic tree structure that causes the TreeObject.insert_child method to enter an infinite loop when processing the file. This leads to excessive resource consumption and potential denial-of-service conditions.

Detection Guidance

To detect this vulnerability, check if your system uses pypdf versions before 6.16.0. Run: pip show pypdf. If the version is less than 6.16.0, the system is vulnerable. Additionally, monitor for unexpected high CPU usage or crashes when processing PDF files, which may indicate an infinite loop caused by malicious PDFs.

Impact Analysis

If you use a vulnerable version of pypdf to process PDF files, an attacker could send you a specially crafted PDF that triggers an infinite loop. This could cause your application to hang or crash, consuming excessive CPU and memory resources. Systems processing many PDFs automatically are particularly at risk.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service conditions through infinite loops in PDF processing. Such disruptions may lead to service unavailability, which could violate availability requirements in these regulations. However, the primary impact is operational rather than direct data exposure or privacy violation.

Mitigation Strategies

Upgrade pypdf to version 6.16.0 or later immediately using: pip install --upgrade pypdf. If immediate upgrade is not possible, apply the changes from pull request #3964 as a temporary workaround. Avoid processing untrusted PDF files until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-84309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70