PT-2026-84461

CVE-2026-84309

Published

2026-08-13

Updated

2026-11-09

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.0

Description An attacker can craft a PDF with a cyclic tree structure that triggers an infinite loop. This occurs when a writing code path utilizes the TreeObject.insert child() function in pypdf/generic/ data structures.py, causing it to follow /Next links indefinitely.

Recommendations Update to version 6.16.0. As a temporary workaround, apply the changes from PR #3964.

Exploitability

Exploit

Fix

Impacts

Researchers

Alienkeric

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

Related identifiers