6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28351

CVE-2026-28351: Manipulated RunLengthDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28351

CVE-2026-28351:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.4	6.7.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the pypdf.filters.RunLengthDecode.decode function, which is responsible for handling Run-Length Decode streams in PDF files. The provided commit patch clearly shows the addition of a size check within this function. Specifically, the code now tracks the total_length of the decompressed data and compares it against a new limit, RUN_LENGTH_MAX_OUTPUT_LENGTH. If the decompressed size exceeds this limit, a LimitReachedError is raised. This directly addresses the reported vulnerability of potential memory exhaustion from a manipulated stream. Therefore, the RunLengthDecode.decode function is the exact location of the vulnerability, and it would be the function appearing in a runtime profile when the vulnerability is triggered.

Vulnerable functions

RunLengthDecode.decode

pypdf/filters.py

The `decode` function within the `RunLengthDecode` class is vulnerable to uncontrolled resource consumption. Before the patch, it would decompress a `RunLengthDecode` stream without any limit on the output size. An attacker could craft a PDF with a small, compressed stream that expands to a very large size, causing the application to exhaust its memory. The patch introduces a check against `RUN_LENGTH_MAX_OUTPUT_LENGTH` to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.