CVE-2026-41312

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

Description

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

Scores

Weaknesses (CWE)

• CWE-789

Advisories

• GHSA-7gw9-cf7v-778f — pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
• PYSEC-2026-3011 — pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

European references

• ENISA EUVD · EUVD-2026-25112
• GCVE · GCVE-0-2026-41312

CERT-FR advisories

• CERTFR-2026-AVI-0698 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* < 6.10.2

Affected products

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f
• https://github.com/py-pdf/pypdf/pull/3734
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2

Sources