Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled iteration and recursion while parsing complex PDF structures that can be manipulated by an attacker. The analysis of the security patch (commit 3633d81826e525fda22ba1878d048395e1d73208) reveals two primary vulnerable functions. The first, PageObject._layout_mode_fonts, is directly related to the advisory's description of an infinite loop during layout-mode text extraction. It occurs because the code, which traverses the object hierarchy via /Parent references, lacked protection against cyclic references. An attacker can craft a PDF where an object is its own ancestor, causing an infinite loop. The second function, PdfWriter._get_filtered_outline, has a similar flaw when processing the document's outline (bookmark) tree. The traversal of /First and /Next references in the outline structure was also vulnerable to an infinite loop if a cyclic path was present in the PDF. The patch for both functions implements the same mitigation strategy: tracking visited nodes using a set to detect and break out of any cycles, thus preventing the denial-of-service condition.
PageObject._layout_mode_fontspypdf/_page.py
PdfWriter._get_filtered_outlinepypdf/_writer.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pypdf | pip | < 6.13.0 | 6.13.0 |