6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54531

CVE-2026-54531: pypdf: Possible infinite loop when processing outlines/bookmarks in writer

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54531

CVE-2026-54531:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.13.0	6.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the processing of PDF structures that can be controlled by an attacker, specifically outlines and page hierarchies. The root cause of the infinite loops is the lack of cycle detection when traversing these structures. An attacker can craft a PDF file with circular references in the outline items (e.g., a /Next or /First key pointing to an already processed item) or in the page tree (e.g., a /Parent key creating a loop). When pypdf attempts to merge or process such a file, the functions _get_filtered_outline and _layout_mode_fonts would enter an infinite loop, as they did not keep track of visited objects. This leads to a denial-of-service condition. The patch addresses this by introducing a visited set in both functions to record the object IDs that have been processed, thus breaking the loop upon encountering a cycle.

Vulnerable functions

PdfWriter._get_filtered_outline

pypdf/_writer.py

The function `_get_filtered_outline` processes PDF outlines. It iterates through outline items using `/Next` and `/First` references. A crafted PDF can create a circular reference in these outlines. The original code did not detect these cycles, causing it to enter an infinite loop while traversing the outline structure. The patch adds a `visited` set to track processed nodes and break the loop if a cycle is detected.

PageObject._layout_mode_fonts

pypdf/_page.py

The function `_layout_mode_fonts` traverses up the page's parent hierarchy (via `/Parent` references) to find font resources. A malicious PDF can contain a cyclic `/Parent` reference, where a page object is an ancestor of itself. The original code's `while` loop did not handle this case, leading to an infinite loop. The patch introduces a `visited` set to detect such cycles and terminate the loop.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.