CVE-2026-24688

MediumCVSS 4.3/10Last modified Nov 2, 2026

Description

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
py-pdf	pypdf	< 6.6.2

References

https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1Patch
https://github.com/py-pdf/pypdf/pull/3610Issue Tracking
https://github.com/py-pdf/pypdf/releases/tag/6.6.2Product, Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73Vendor Advisory

Timeline

Published: Jan 27, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-246898.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote c CVE-2026-24697.6Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used CVE-2026-246907.5Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.CVE-2026-246924.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoint CVE-2026-246936.7Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow CVE-2026-246948.4The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to CVE-2026-246958.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remot CVE-2026-246967.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-246977.2An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 CVE-2026-246987.2An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware CVE-2026-246997.2An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and CVE-2026-24704.3The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up