CVE-2026-31826 MEDIUM

CVE-2026-31826: pypdf: manipulated stream length values can exhaust RAM

Vendor Py-Pdf
Product pypdf
Weakness CWE-770 · Uncontrolled resource consumption
Published March 10, 2026
Last update March 11, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.

Key dates

02Disclosure timeline

March 10, 2026 CVE published
March 11, 2026 Record updated