Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

CVE-2025-64512---pdfminer.six-Remote-Code-Execution-RCE-

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE -orange WARNING – EDUCATIONAL USE ONLY This proof-of-concept is for authorized security testing and educational purposes only. Use only on systems you own or have explicit written permission to test. The author is not responsible for any...

CVE-2025-20260

CVE-2025-20260 - ClamAV PDF Scanning Buffer Overflow First Public PoC First public proof-of-concept for CVE-2025-20260 CVSS 3.1 base score 9.8, Critical, a buffer-overflow vulnerability in the PDF scanning path of ClamAV. This repository contains a generator for the malicious PDF that triggers th...

CVE-2025-50420

Poppler before version 25.07.0 contains a vulnerability in its pdfseparate utility's PDFDoc processing logic: crafted "/Annots" dictionaries that reference themselves or each other lead to infinite recursion in "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject --...

Google Chrome buffer error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a buffer error vulnerability stemming from memory corruption in PDF processing. Remote attackers can exploit this via specially crafted HTML pages...

[SECURITY] Fedora 45 Update: ocaml-cpdf-2.9-4.fc45

OCaml library and command line tool for processing PDFs, for example merging and splitting, adding text, or compressing...

Astra Linux – Vulnerability in qpdf

QPDF versions 9.x through 9.1.1, and 10.x through 10.0.4 have a heap-based buffer overflow in the PlASCII85Decoder::write function invoked from PlAESPDF::flush and PlAESPDF::finish when a certain downstream write operation fails...

PyPDF _get_outline() Heap Buffer Overflow DoS

The vulnerability of the getoutline function in the pypdf/doccommon.py library of the Python PDF handling library PyPDF is related to asymmetric resource consumption. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-85458

A flaw was found in Xpdf. This vulnerability, a divide-by-zero error, occurs when the application processes a Type 3 font glyph that has a zero height. A local attacker could exploit this condition to trigger a crash, leading to a denial of service and making the application unavailable. Mitigati...

PyPDF Excessive Iteration DoS

The vulnerability of the Python library for working with PDF files, PyPDF, is related to excessive iteration. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PyPDF Resource Exhaustion

The vulnerability of the Python library for working with PDF files, PyPDF, is related to the unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

ClamAV PDF File Format Processing Memory Corruption Vulnerability

...

CVE-2026-71852

A flaw was found in pypdf. A remote attacker could provide a specially crafted PDF file that, when processed by the Font.collectcidcharacterwidths function during text extraction, causes the library to expand unusually large font width ranges. This can lead to excessive memory consumption and lon...

XML External Entity (XXE)

veraPDF-validation is vulnerable to an XML External Entity XXE. The vulnerability is due to improper processing of XML external entities in malicious rich-text /RC or /RV entries within a crafted PDF, which allows an attacker to exploit external entity expansion and disclose local file contents...

CVE-2026-45802 FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script...

CVE-2026-45802

CVE-2026-45802 affects FPDI, a PHP library that reads pages from existing PDFs to use as templates in FPDF. The issue, present in versions prior to 2.6.7, allows an attacker to upload a small malicious PDF that exhausts memory or triggers script timeouts, causing the server-side process to crash ...

openSUSE 16 Security Update : python-Pillow (openSUSE-SU-2026:20831-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20831-1 advisory. This update for python-Pillow fixes the following issues - CVE-2026-42308: integer overflow in font processing can lead to denial of service...

SUSE-SU-2026:21861-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-42308: integer overflow in font processing can lead to denial of service bsc1265359. - CVE-2026-42309: heap buffer overflow when processing nested list coordinates bsc1265153. - CVE-2026-42310: infinite loop and resource exhausti...

PyPDF2 Loop Unreachable Exit Condition DoS

The vulnerability of the PyPDF2 library for processing PDF files relates to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PyPDF2 Excessive Iteration DoS

The vulnerability of the PyPDF2 library for processing PDF files is related to excessive iteration. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...