Security readout for executives and security teams
Plain-English summary
CVE-2026-27628 affects pypdf, a Python PDF-processing library. A specially crafted PDF with circular cross-reference “/Prev” entries can cause pypdf to enter an infinite loop when the file is read. Business impact is limited to availability of the processing task or service handling that PDF. The issue is fixed in pypdf 6.7.2.
Executive priority
Treat as routine remediation unless the organization heavily processes untrusted PDFs at scale. Prioritize upgrade in internet-facing upload services, document automation, email ingestion, or batch-processing environments where a hung worker could affect service availability.
Technical view
Before pypdf 6.7.2, circular /Prev entries in PDF cross-reference streams can trigger CWE-835: loop with unreachable exit condition. The CVSS 4.0 score is 1.2, reflecting network deliverability but user/application interaction and low availability impact only. No confidentiality or integrity impact is described in the provided sources.
Likely exposure
Exposure is most relevant for applications, workers, or pipelines that use pypdf versions earlier than 6.7.2 to read PDFs from users, partners, email, uploads, or other untrusted sources. Systems that do not parse untrusted PDFs with pypdf are unlikely to be affected.
Exploitation context
The provided sources do not report active exploitation, and this CVE is not listed as KEV. Exploitation requires a crafted PDF to be read by vulnerable pypdf code. The likely outcome is a hung process or resource consumption in PDF handling, not data theft or code execution based on available evidence.
Researcher notes
Evidence points to a narrow denial-of-service condition in PDF parsing logic. The linked commit is the authoritative fix reference, and the GitHub advisory names the affected range and workaround. Sources do not provide evidence of exploitation in the wild or impact beyond low availability loss.
Mitigation direction
- Upgrade pypdf to version 6.7.2 or later.
- If immediate upgrade is blocked, review the upstream advisory for the manual patch workaround.
- Limit or isolate processing of untrusted PDFs until patched.
- Apply timeouts or worker recycling around PDF processing where operationally appropriate.
Validation and detection
- Inventory applications and services that depend on pypdf.
- Confirm installed pypdf versions are 6.7.2 or later.
- Identify workflows that read PDFs from untrusted or external sources.
- Review dependency lockfiles and build artifacts for vulnerable pypdf versions.
- Monitor PDF processing jobs for hangs or abnormal runtime until remediation is complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27628 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 1.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
1.2LowVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35CVE reference · x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/issues/3654CVE reference · x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.