ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27888

pypdf is a free and open-source pure-python PDF library.

Published Feb 26, 2026 · updated Jun 17, 2026 · pypdf project pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the property of a reader or writer and the corresponding stream being compressed using . This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 26, 2026 · NIST NVD

    Detected

    pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the property of a reader or writer and the corresponding stream being compressed using . This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

  2. Jun 17, 2026 · NIST NVD

    Updated

    pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the property of a reader or writer and the corresponding stream being compressed using . This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

Affected

  • cpe pypdf project/pypdfversion unspecified

Sources

  • NIST NVDVulnerability recordCVE-2026-27888

    pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the property of a reader or writer and the corresponding stream being compressed

    nvd.nist.gov

References