Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service issue caused by uncontrolled resource consumption (CWE-400) in the pypdf library. Specifically, when extracting text from a PDF page, the code did not handle cyclic references in form XObjects. An attacker can create a PDF where a form XObject contains a reference to itself. When pypdf processes this file, the text extraction process enters an infinite recursion. The analysis of the patch in commit 59e3e29f62428a62af9a1a42bb88f85a623301ef shows that the functions _extract_text and extract_xform_text within the PageObject class (pypdf/_page.py) were modified to address this. The fix involves passing a set of known_ids (object IDs of XObjects) through the recursive calls. Before processing a form XObject, the code now checks if its ID is already in the known_ids set. If it is, a cyclic reference is detected, the recursion is stopped, and a warning is logged. This prevents the infinite loop and the resulting memory exhaustion. Therefore, the vulnerable functions are PageObject._extract_text and PageObject.extract_xform_text, as they contained the flawed recursive logic.
PageObject._extract_textpypdf/_page.py
PageObject.extract_xform_textpypdf/_page.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pypdf | pip | < 6.12.2 | 6.12.2 |