CVE-2021-45067

CVE-2021-45067 Эта ошибка представляла собой чтение за пределами выделенной памяти, вызванное обработкой строки ANSI как Unicode, что может быть использовано для утечки конфиденциальной информации из изолированного процесса Adobe Reader. Блог Adobe Reader - XFA - Путаница ANSI и Unicode - Утечка...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Минимальная среда для проверки Этот проект предназначен для проверки CVE-2025-66516 уязвимость внедрения внешних сущностей XML в Apache Tika. Описание уязвимости Apache Tika версии 3.2.1 и более ранние не отключали корректно загрузку внешних сущностей при разборе PDF-файлов,...

CVE-2025-66516-Writeup-POC

CVE-2025-66516 : Vulnérabilité XXE Critique dans Apache Tika Résumé Exécutif CVE-2025-66516 est une vulnérabilité critique d'injection d'entités externes XML XXE dans Apache Tika avec un score CVSS de 10.0 sévérité maximale. La vulnérabilité permet à un attaquant distant de lire des fichiers...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Vulnérabilité critique Apache Tika CVSS : 10.0 | Type d'exploitation : Injection XXE | Niveau de risque : MAXIMUM 🎯 Résumé exécutif CVE-2025-66516 est une vulnérabilité critique d'entité externe XML XXE dans le moteur de traitement central d'Apache Tika. Un seul PDF malveillant...

POC-CVE-2025-54988

CVE-2025-54988 - POC Отказ от ответственности: Я не являюсь первоначальным автором данной уязвимости. Этот пост документирует мой процесс воспроизведения проблемы в контролируемой среде в образовательных целях и для помощи другим в проверке их собственных систем. Тесты проводились в изолированной...

CVE-2025-66516-POC

⚠️ LISEZ L'AVERTISSEMENT AVANT UTILISATION ⚠️ Test pédagogique/uniquement autorisé | Licence | Politique de sécurité...

GHSA-36MM-W85J-3Q2J veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

EUVD-2026-50368

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

PYSEC-2026-3027 pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2026-5939

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...

CVE-2026-5939 UAF in Foxit PDF Editor/Reader via XFA calculate event

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...

CVE-2026-5939

CVE-2026-5939 describes a use-after-free (UAF) vulnerability in Foxit PDF Editor/Reader triggered by a crafted XFA PDF during the calculate event. The issue affects the application when processing XFA calculate logic, potentially crashing the program and enabling arbitrary code execution. The lin...

EUVD-2025-209415

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

PT-2026-32375

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

OPENSUSE-SU-2026:20333-1 Security update for python-PyPDF2

This update for python-PyPDF2 fixes the following issues: Changes in python-PyPDF2: - CVE-2026-27628: Fixed infinite loop when loading circular /Prev entries in cross-reference streams bsc1258940 - CVE-2026-27888: Fixed issue where manipulated FlateDecode XFA streams can exhaust RAM bsc1258934 -...

📄 pypdf Memory Exhaustion / Denial of Service

pypdf versions prior to 6.7.3 were vulnerable to a denial of service condition caused by uncontrolled memory allocation during decompression of XFA streams. An attacker could craft a malicious PDF file containing a highly compressed stream using /FlateDecode...

Linux Distros Unpatched Vulnerability : CVE-2026-27888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being...