4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41313

CVE-2026-41313: pypdf: Possible long runtimes for wrong size values in incremental mode

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3735.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41313

CVE-2026-41313:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.10.2	6.10.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the pypdf library's handling of PDF files in incremental parsing mode. An attacker can craft a PDF with a trailer containing a very large /Size value. The pypdf library, specifically the PdfWriter.clone_reader_document_root function, would previously trust this value and attempt to allocate memory for that number of objects. This leads to excessive memory allocation and CPU usage, resulting in a denial of service. The patch, identified in commit c50a0104cf083356f7c7f5d61410466a57f5c88a, rectifies this by no longer trusting the /Size value. Instead, it inspects the PDF's cross-reference tables to determine the actual number of objects to process, and it introduces configurable limits (incremental_clone_object_count_limit and incremental_clone_object_id_limit) on the number of objects and their IDs as a further safeguard. The primary vulnerable function is PdfWriter.clone_reader_document_root, which is called from PdfWriter.__init__ when incremental=True.

Vulnerable functions

PdfWriter.clone_reader_document_root

pypdf/_writer.py

The function `clone_reader_document_root` in the `PdfWriter` class is vulnerable. When a `PdfWriter` is instantiated in incremental mode (`incremental=True`), this function is called to clone the objects from the source PDF. The vulnerable version of the code reads the `/Size` value from the PDF's trailer and allocates a list of that size. An attacker can craft a PDF with an excessively large `/Size` value, causing the application to allocate a huge list, leading to excessive memory consumption and long processing times, resulting in a denial of service.

PdfWriter.__init__

pypdf/_writer.py

The `__init__` method of the `PdfWriter` class serves as the entry point for the vulnerability. When a `PdfWriter` object is created with `incremental=True`, it reads the provided PDF file and calls the vulnerable `clone_reader_document_root` method. Therefore, an attacker triggers the vulnerability by causing the application to instantiate `PdfWriter` in this manner with a malicious PDF file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.