CVE-2026-41314: 
Python vulnerability analysis and mitigation

CVE-2026-41314 is a memory exhaustion vulnerability in pypdf, a free and open-source pure-Python PDF library, that allows an attacker to craft a malicious PDF file causing the host system's RAM to be exhausted. The vulnerability affects all pypdf versions prior to 6.10.2 and was disclosed on April 22, 2026, with the fix released on April 15, 2026. It is classified as CWE-789 (Memory Allocation with Excessive Size Value) and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is insufficient validation of image dimension parameters when processing /FlateDecode-encoded images in PDF files (CWE-789). pypdf trusted attacker-controlled values for image size fields — including columns, colors, bits-per-component, row length, and buffer size — without enforcing upper bounds, allowing arbitrarily large memory allocations. The fix introduced explicit limits: FLATE_MAX_COLUMNS (250,000), FLATE_MAX_ROW_LENGTH (4 MB), and FLATE_MAX_BUFFER_SIZE (75 MB), and added validation for colors (≤16) and bits-per-component (≤16). Exploitation requires user interaction — the victim application must open or process the crafted PDF (GitHub PR #3734, GitHub Commit).

Successful exploitation causes a denial-of-service condition by exhausting system RAM, potentially crashing the application or rendering the host system unresponsive. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Applications that automatically process user-supplied or externally sourced PDF files (e.g., document processing pipelines, web services) are at elevated risk, as a single malicious PDF can bring down the processing service (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (the target must open the crafted PDF), which further limits the attack surface (Feedly, GitHub Advisory).

1. Craft a malicious PDF: Create a PDF file containing an image stream that uses the /FlateDecode filter with manipulated dimension parameters — specifically, set /Columns, /Colors, or image width/height values to extremely large numbers (e.g., /Columns > 250,000 or image dimensions yielding a buffer > 75 MB).
2. Embed the image stream: Include the crafted image XObject in the PDF structure with a valid /FlateDecode filter declaration but with oversized /Width, /Height, or predictor parameters in the stream dictionary.
3. Deliver the PDF: Send the crafted PDF to a target that processes it with a vulnerable version of pypdf (< 6.10.2) — for example, via email attachment, file upload to a web service, or a shared document repository.
4. Trigger memory exhaustion: When the application calls pypdf to read or extract images from the PDF, pypdf attempts to allocate a buffer proportional to the declared (attacker-controlled) image dimensions, exhausting available RAM and causing a denial-of-service condition (GitHub Advisory, GitHub Commit).

• Logs: Application logs showing LimitReachedError or MemoryError exceptions originating from pypdf/filters.py or pypdf/generic/_image_xobject.py during PDF processing; repeated out-of-memory (OOM) errors in system logs (e.g., Linux kernel OOM killer messages).
• Process Behavior: PDF-processing worker processes consuming abnormally high RAM (approaching system limits) before crashing; sudden termination of Python processes handling PDF files.
• File System: Presence of suspicious PDF files with unusually small file sizes but containing image streams with extremely large declared dimension values (detectable via PDF forensic tools such as pdfid or pdf-parser).
• Network: Repeated submission of the same or similar PDF files to a document processing endpoint, particularly from external or untrusted sources.

The vulnerability is fixed in pypdf 6.10.2, released April 15, 2026. Users should upgrade immediately using pip install --upgrade pypdf. For environments where immediate upgrading is not feasible, the changes from PR #3734 and commit ac734da can be applied manually. Additionally, operators should restrict PDF processing to trusted sources, implement OS-level memory limits (e.g., ulimit or cgroup memory limits) for PDF-processing processes, and monitor for anomalous memory consumption (GitHub Advisory, pypdf Release 6.10.2).

The vulnerability was reported by researcher l3b4nk4 and analyzed and patched by pypdf maintainer stefan6419846. The fix was incorporated into the pypdf 6.10.2 release on April 15, 2026, and the advisory was published on April 22, 2026. Downstream package maintainers, including NixOS/nixpkgs, promptly opened issues to update their pypdf dependency following the disclosure (GitHub Advisory, GitHub PR #3734).