CVE-2026-24688
MEDIUMpypdf < 6.6.2 - Denial of Service via Infinite Loop in Outline Processing
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-24688. PoCs published by SecureWithUmer, Fomovet, JoakimBulow.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-24688, a denial-of-service vulnerability in pypdf's outline parsing logic. The exploit creates PDFs with circular outline references that trigger infinite loops and memory exhaustion when processed by vulnerable versions of pypdf (6.6.0).
Description
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.
Exploits (3)
This repository contains a functional proof-of-concept for CVE-2026-24688, a denial-of-service vulnerability in pypdf's outline parsing logic. The exploit creates PDFs with circular outline references that trigger infinite loops and memory exhaustion when processed by vulnerable versions of pypdf (6.6.0).
This repository contains a functional exploit PoC for CVE-2026-24688, demonstrating a DoS vulnerability in pypdf's outline parsing logic via circular references. The exploit generates malicious PDFs that trigger infinite loops, causing CPU spikes and memory exhaustion.
This repository contains a working proof-of-concept for CVE-2026-24688, a critical Denial of Service (DoS) vulnerability in pypdf's outline parsing logic. The exploit demonstrates how circular references in PDF outlines cause an infinite loop, leading to system-wide crashes due to uncontrolled memory allocation.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L