CVE-2026-113786

A flaw was found in pypdf. A remote attacker could trigger a Denial of Service DoS or unexpected behavior by enticing a user or service to process a specially crafted PDF document. When an image marked with a JPEG filter is loaded, pypdf fails to restrict decoding to the JPEG format before passin...

CVE-2026-113795

A flaw was found in pypdf. A remote attacker could cause a Denial of Service DoS by convincing a user or application to process a specially crafted PDF document. By providing a PDF stream configured with an excessive number of filters or filters that pass around large volumes of data, an attacker...

CVE-2026-113793

A flaw was found in pypdf. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted PDF document containing cyclic tree structures. When an application attempts to remove an object from the cyclic structure, the library enters an infinite loop,...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibreOffice vulnerabilities (USN-8868-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory. It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause...

USN-8868-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

USN-8868-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

CVE-2026-95338

An use after free flaw was found in the PDFium component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556535630...

CVE-2026-63273

A flaw was found in LibreOffice Draw. This vulnerability allows a remote attacker to cause a denial of service by crafting a specially designed encrypted PDF document. When a user opens this malicious document, a heap buffer overflow occurs because the software incorrectly handles the decryption...

CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47851

CVE-2026-47851 is a denial-of-service vulnerability in the Spring AI PDF Document Reader . When analyzing a PDF whose table of contents (outline tree) is deeply nested or cyclic, unbounded recursion triggers a StackOverflowError in the ingestion thread. The attack requires no privileges or user i...

CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

io.github.agentic-spring-ai:agentic-spring-ai-starter-document-parser-apache-pdfbox (2.0.0.0), io.github.agentic-spring-ai:agentic-spring-ai-starter-document-parser-bibtex (2.0.0.0) +1 more potentially affected by CVE-2026-47851 via org.springframework.ai:spring-ai-pdf-document-reader (2.0.0)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-pdf-document-reader and may be impacted: -...

CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

ai.telosforge:kimaira-starter-etl (>=1.2.4, <=1.2.6), cn.echoparrot:echoparrot-application (25.4.0) +21 more potentially affected by CVE-2026-47851 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.0.0, <=2.0.0)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.0.0, =1.2.4, =25.4.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.1.2.4, =1.1.2.4, =1.1.2.4, =2.0.0.0 - io.github.dpgaharwal:pageindex-spring-ai 1.0.0 and more Source cves: CVE-2026-47851 Source...

Uncontrolled Recursion

Overview org.springframework.ai:spring-ai-pdf-document-reader is a Spring AI PDF document reader Affected versions of this package are vulnerable to Uncontrolled Recursion in an ingestion thread. An attacker can cause a denial of service by submitting a PDF with a deeply nested or cyclic table of...

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...

PT-2026-66306

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description Insufficient validation of untrusted input in Notifications allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape by using a crafted...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

PYSEC-2026-3027 pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...

CVE-2026-57254

There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash...