pypdf: Possible long runtimes/large memory usage when extracting XForm objects

低 3.3CVE-2026-84311 · GHSA-763m-79hh-57f2 · PYSEC-2026-3911 · 01/09/2026 公開 · 05/10/2026 更新

要点

CVE-2026-84311 は pypdf, pypdf (pypdf project) に影響する深刻度「低」 (CVSS 3.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.14%（全脆弱性の 2.9% より高い）。
対処：6.16.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pypdf PyPI	`< 6.16.1`	`6.16.1`
pypdf pypdf_project	`< 6.16.1`	`6.16.1`

概要

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3966.

NVD の説明

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.