CVE-2026-113791

What it actually does

Crafted PDF content streams containing numerous small operations trigger unbounded memory allocation during parsing, leading to exhaustion and denial of service.

Why it matters to the business

Applications or services that process untrusted PDFs may experience sudden resource spikes, crashes, or degraded performance, interrupting document workflows and requiring restarts.

How an attack unfolds

An attacker generates a malicious PDF embedding a content stream with many tiny operations, then supplies the file to any pypdf-based parser; the library allocates excessive memory while processing the stream, causing the consuming process to become unresponsive or terminate.

How to fix it

Upgrade pypdf to version 6.21.0 or later; avoid processing untrusted PDFs until patched.

How to confirm the fix worked

Confirm the installed pypdf version is at least 6.21.0; attempt to parse a test PDF known to trigger the condition and verify memory usage remains bounded.

Typical attack path

1. Generate PDF containing a content stream with a large number of small operations
2. Deliver the PDF to a target application that uses pypdf for parsing
3. Trigger parsing of the malicious stream
4. Observe memory exhaustion leading to process slowdown or crash

How to detect it

Review application and system logs for sudden spikes in memory usage or out-of-memory events during PDF processing; correlate with file ingestion timestamps.

What your security team should do

• Prioritize upgrade to pypdf 6.21.0 across all environments within the next maintenance window
• Implement input validation or sandboxing for PDF processing until patches are applied
• Monitor memory consumption metrics for PDF-handling services
• Review EPSS trend and reassess exploit maturity weekly