6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27888

CVE-2026-27888: pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27888

CVE-2026-27888:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.3	6.7.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the xfa property of the DocCommon class in pypdf/_doc_common.py. The analysis of the patch commit 7a4c8246ed48d9d328fb596942271da47b6d109c clearly shows the replacement of an unbounded zlib.decompress call with a size-limited custom function _decompress_with_limit. The vulnerability is a classic resource exhaustion (CWE-400) issue, where a specially crafted compressed input (a 'zip bomb') in the XFA part of a PDF can cause the application to run out of memory. The vulnerable function DocCommon.xfa is the entry point for processing this malicious input. Both PdfReader and PdfWriter classes inherit from DocCommon, so any code accessing the .xfa property on instances of these classes would trigger the vulnerability.

Vulnerable functions

DocCommon.xfa

pypdf/_doc_common.py

The `xfa` property in the `DocCommon` class is vulnerable. It processes XFA streams from a PDF. If a stream is compressed using FlateDecode, the function previously used `zlib.decompress` without any size limit on the output. This allows an attacker to craft a malicious PDF with a compressed stream that expands to a very large size (a 'zip bomb'), causing excessive memory consumption and leading to a denial of service when the `.xfa` property is accessed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.