CVE-2026-41312 PUBLISHED

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

Assigner: GitHub_M
Reserved: 20.04.2026 Published: 22.04.2026 Updated: 22.04.2026

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 4.8

Product Status

Vendor py-pdf
Product pypdf
Versions
  • Version < 6.10.2 is affected

References

Problem Types

  • CWE-789: Memory Allocation with Excessive Size Value CWE