Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit 507d7c9aa6ea83389b954b9c3c0c528fe5d5da70 clearly indicates that the vulnerability is located in the _sanitize_pdf15_xref_stream_index_pairs method of the PdfReader class in pypdf/_reader.py. The vulnerability is a denial-of-service caused by excessive iteration. An attacker can craft a PDF with a cross-reference stream that has its width array /W set to [0, 0, 0] and a large /Size value. The vulnerable version of the code would incorrectly calculate the minimum size of an entry as 1 byte. This would lead to an attempt to process a huge number of entries, as specified by the large /Size value, resulting in a long-running loop that consumes significant CPU resources. The patch fixes this by explicitly checking if the sum of the entry widths is zero. If it is, it indicates that no data can be encoded in the stream, and the function exits early, preventing the excessive iteration.
PdfReader._sanitize_pdf15_xref_stream_index_pairspypdf/_reader.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pypdf | pip | < 6.12.0 | 6.12.0 |