CVE-2026-24688

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a PDF generator (create_malicious_pdf.py) that crafts a PDF with circular outline references, and a reader script (simple_read_pdf.py) that triggers the infinite loop vulnerability in pypdf by accessing reader.outline. The README explicitly describes this as a PoC for CVE-2026-24688 and provides instructions to run the exploit.

Backdoor review

No backdoor observed in reviewed code

The supplied text files (README.md, create_malicious_pdf.py, simple_read_pdf.py) describe and implement a proof-of-concept for CVE-2026-24688, an infinite loop vulnerability in pypdf's outline parsing. The Python scripts construct a malicious PDF with circular outline references and read it to trigger the documented denial-of-service behavior. No backdoor, concealed payload, or operator-directed harm is present in the reviewed text. One binary PDF (malicious_circular_outline.pdf) was flagged as metadata-only and not analyzed; its purpose is consistent with the PoC and no suspicious behavior is indicated by the surrounding text.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarepypdf
Attack typesdenial of service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes code that generates a malicious PDF and code that exercises the vulnerability by reading the outline, which triggers the infinite loop. This is an exploit, not a scanner, because it actively triggers the vulnerability rather than merely detecting it.

Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93Fomovet-cve-2026-24688-0b13ba0/simple_read_pdf.py:76-84Fomovet-cve-2026-24688-0b13ba0/README.md:3

Requirements

  • pypdf version < 6.6.2 must be installedFomovet-cve-2026-24688-0b13ba0/README.md:44
  • The malicious PDF must be generated or providedFomovet-cve-2026-24688-0b13ba0/README.md:15

Observed behavior

  • Generates a PDF with circular outline references (A -> B -> A)Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93
  • Opens the malicious PDF and accesses reader.outline, triggering an infinite loopFomovet-cve-2026-24688-0b13ba0/simple_read_pdf.py:76-84
  • Consumes memory and CPU until system crash or manual interruptionFomovet-cve-2026-24688-0b13ba0/README.md:7-9
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Binary File Not Analyzed
malicious_circular_outline.pdf (sha256:bfed84cb8358c32d182e222b0df7add60e9e5e4675bea471bb881b883226174e)The PDF is the exploit artifact generated by create_malicious_pdf.py. It was not analyzed for embedded active content, but the text scripts describe it as a PDF with circular outline references designed to trigger an infinite loop in pypdf.Fomovet-cve-2026-24688-0b13ba0/README.md:15Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93
Review boundaries

What the analysis did not establish

  • One binary file (malicious_circular_outline.pdf) is present but not analyzed; its content is flagged as binary and metadata only.
  • The test_pypdf.sh script is listed in the README but not included in the text evidence.
  • One binary file (malicious_circular_outline.pdf, 754 bytes) was flagged as metadata-only and not analyzed for embedded active content. The review cannot confirm the PDF contains only the described circular outline structure.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1