PT-2026-22400

CVE-2026-28351

Published

2026-02-27

Updated

2026-08-14

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.7.4

Description The pypdf library is susceptible to a resource exhaustion issue. An attacker can create a specially crafted PDF file that causes excessive memory usage when processed using the RunLengthDecode filter. This can lead to a denial-of-service condition.

Recommendations Versions prior to 6.7.4 should be upgraded to version 6.7.4 or later. As a temporary workaround, consider applying the changes from PR #3664.

Exploitability

Exploit

Fix

Impacts

Researchers

Bugbunny-Research

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

Related identifiers

CVE-2026-28351