CVE-2026-119203: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

October 30, 2026

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer.

References

github.com/advisories/GHSA-5849-834g-hvw5
github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a
github.com/py-pdf/pypdf/pull/4289
github.com/py-pdf/pypdf/releases/tag/6.21.4
github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
nvd.nist.gov/vuln/detail/CVE-2026-119203

Code Behaviors & Features

Detect and mitigate CVE-2026-119203 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →