CVE-2026-84311: pypdf: Possible long runtimes/large memory usage when extracting XForm objects

September 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.

References

github.com/advisories/GHSA-763m-79hh-57f2
github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942
github.com/py-pdf/pypdf/pull/3966
github.com/py-pdf/pypdf/releases/tag/6.16.1
github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2
nvd.nist.gov/vuln/detail/CVE-2026-84311

Code Behaviors & Features

Detect and mitigate CVE-2026-84311 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →