CVE-2026-33123 — pypdf has inefficient decoding of array-based streams
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usag…
Published: 2026-03-20 · CVSS: 5.1 · CVSS 4.0
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7