Skip to content

Manipulated RunLengthDecode streams can exhaust RAM

Moderate
stefan6419846 published GHSA-f2v5-7jq9-h8cg Feb 27, 2026

Package

pip pypdf (pip)

Affected versions

< 6.7.4

Patched versions

>= 6.7.4

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.

Patches

This has been fixed in pypdf==6.7.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3664.

Severity

Moderate

CVE ID

CVE-2026-28351

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource. Learn more on MITRE.

Credits