LiveActive security incident?Get immediate response
CVE Record

CVE-2026-27888: pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

MediumCVSS 6.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A crafted PDF can make vulnerable pypdf applications run out of memory, but only when the application accesses XFA data and the XFA stream uses FlateDecode compression. This is a denial-of-service risk, not a data theft issue in the cited sources.

Executive priority

Prioritize remediation for internet-facing or automated document-processing systems. Business impact is service disruption from memory exhaustion, not confirmed compromise. Upgrade during the next normal security patch cycle unless exposed systems process untrusted PDFs at scale.

Technical view

CVE-2026-27888 is a CWE-400 resource exhaustion flaw in pypdf before 6.7.3. Manipulated FlateDecode-compressed XFA streams can exhaust RAM when reader or writer code accesses the xfa property. The advisory lists pypdf 6.7.3 as fixed and manual patching as a workaround.

Likely exposure

Exposure is most likely in Python services using pypdf below 6.7.3 to process untrusted PDFs and read XFA content. General pypdf use without accessing the xfa property may not meet the vulnerable condition described by the source bundle.

Exploitation context

The CVSS vector indicates network attackability, low complexity, no privileges, and high availability impact. The bundle does not cite active exploitation, and KEV is false, so treat exploitation as plausible but not confirmed in the provided evidence.

Researcher notes

The key condition is xfa property access on FlateDecode-compressed XFA streams. The provided sources name the fixed release and patch but do not include evidence of exploitation in the wild. Validation should focus on dependency version, XFA code paths, and untrusted PDF entry points.

Mitigation direction

  • Upgrade pypdf to version 6.7.3 or later.
  • If immediate upgrade is blocked, apply the vendor patch manually.
  • Avoid accessing xfa on untrusted PDFs until fixed.
  • Run PDF processing with memory limits and worker isolation.
  • Monitor PDF processing for out-of-memory failures.

Validation and detection

  • Inventory applications and containers using pypdf.
  • Confirm installed pypdf versions are 6.7.3 or later.
  • Search code for reader or writer xfa property access.
  • Identify PDF upload or ingestion paths accepting untrusted files.
  • Review dependency lockfiles and deployed package versions.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-400: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-27888 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.6 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.6CVSS 4.0MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U——GitHub_M

Vulnerability scoring details

Base CVSS 4.0 score

6.6Medium
CVSS 4.0 vector shape for CVE-2026-27888Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
py-pdfpypdf< 6.7.3Listed
Weakness

CWE details

CWE-400

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.