1345 matches found
CVE-2026-115572
A flaw was found in pypdf. An attacker can supply a specially crafted PDF document containing repeated references to nonexistent objects, triggering repetitive full-file recovery attempts during parsing. When processed, this flaw leads to excessive resource consumption and significant delays,...
CVE-2026-113786
A flaw was found in pypdf. A remote attacker could trigger a Denial of Service DoS or unexpected behavior by enticing a user or service to process a specially crafted PDF document. When an image marked with a JPEG filter is loaded, pypdf fails to restrict decoding to the JPEG format before passin...
CVE-2026-113795
A flaw was found in pypdf. A remote attacker could cause a Denial of Service DoS by convincing a user or application to process a specially crafted PDF document. By providing a PDF stream configured with an excessive number of filters or filters that pass around large volumes of data, an attacker...
CVE-2026-113793
A flaw was found in pypdf. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted PDF document containing cyclic tree structures. When an application attempts to remove an object from the cyclic structure, the library enters an infinite loop,...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibreOffice vulnerabilities (USN-8868-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory. It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause...
USN-8868-1 libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...
USN-8868-1: LibreOffice vulnerabilities
It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...
CVE-2026-95338
An use after free flaw was found in the PDFium component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556535630...
CVE-2026-63273
A flaw was found in LibreOffice Draw. This vulnerability allows a remote attacker to cause a denial of service by crafting a specially designed encrypted PDF document. When a user opens this malicious document, a heap buffer overflow occurs because the software incorrectly handles the decryption...
CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...
CVE-2026-47851
CVE-2026-47851 is a denial-of-service vulnerability in the Spring AI PDF Document Reader . When analyzing a PDF whose table of contents (outline tree) is deeply nested or cyclic, unbounded recursion triggers a StackOverflowError in the ingestion thread. The attack requires no privileges or user i...
CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...
io.github.agentic-spring-ai:agentic-spring-ai-starter-document-parser-apache-pdfbox (2.0.0.0), io.github.agentic-spring-ai:agentic-spring-ai-starter-document-parser-bibtex (2.0.0.0) +1 more potentially affected by CVE-2026-47851 via org.springframework.ai:spring-ai-pdf-document-reader (2.0.0)
org.springframework.ai:spring-ai-pdf-document-reader MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-pdf-document-reader and may be impacted: -...
CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...
ai.telosforge:kimaira-starter-etl (>=1.2.4, <=1.2.6), cn.echoparrot:echoparrot-application (25.4.0) +21 more potentially affected by CVE-2026-47851 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.0.0, <=2.0.0)
org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.0.0, =1.2.4, =25.4.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.1.2.4, =1.1.2.4, =1.1.2.4, =2.0.0.0 - io.github.dpgaharwal:pageindex-spring-ai 1.0.0 and more Source cves: CVE-2026-47851 Source...
Uncontrolled Recursion
Overview org.springframework.ai:spring-ai-pdf-document-reader is a Spring AI PDF document reader Affected versions of this package are vulnerable to Uncontrolled Recursion in an ingestion thread. An attacker can cause a denial of service by submitting a PDF with a deeply nested or cyclic table of...
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...
PT-2026-66306
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description Insufficient validation of untrusted input in Notifications allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape by using a crafted...
atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...
PYSEC-2026-3027 pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...