CVE-2026-54530

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

View on CVE.org
Published Jun 22, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.

Analysis

AI-generated

Technical impact

A crafted PDF that triggers an infinite loop during font retrieval in layout-mode text extraction causes the pypdf library to consume CPU and memory indefinitely, effectively denying service to the process that is handling the PDF. This flaw is a classic infinite loop vulnerability, classified as CWE‑835, and leads to resource exhaustion without compromising confidentiality or integrity.

Affected Systems

Applications that incorporate py-pdf’s pypdf library and perform text extraction in layout mode are affected. Versions of pypdf earlier than 6.13.0 are vulnerable; the fix is released in pypdf 6.13.0 and later.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating a moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by providing a malicious PDF to any service or user that calls pypdf’s layout‑mode extraction – a local or remote vector if the application exposes that functionality. The impact is limited to denial of service for the affected process rather than data breach or code execution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the pypdf library to version 6.13.0 or later to apply the fixed code.
  • If upgrading immediately is not feasible, avoid invoking layout-mode text extraction on PDFs from untrusted sources until a patch can be applied.
  • Monitor resource usage and enforce limits for processes that perform PDF parsing, so that an infinite loop can be detected and terminated before it affects system availability.

Generated by OpenCVE AI on June 22, 2026 at 22:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-52x6-gq3r-vpf4 pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
History
Type Values Removed Values Added
CPEs cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*
Vendors & Products Pypdf Project
Pypdf Project pypdf
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Py-pdf
Py-pdf pypdf
Vendors & Products Py-pdf
Py-pdf pypdf
Type Values Removed Values Added
Description pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.
Title pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jun 23, 2026, 4:11 PM
Reserved
Jun 15, 2026, 6:40 PM

View source JSON

Updated
Jun 23, 2026, 2:52 PM

JSON

Status
Analyzed
Published
Jun 22, 2026, 9:16 PM
Modified
Nov 2, 2026, 4:06 PM

View source JSON

Severity
Moderate
Public date
Jun 22, 2026, 8:25 PM

View source Bugzilla JSON

Updated
Jun 23, 2026, 12:15 AM

JSON