CVE-2026-82398

mediumcovered by 2 sourcesfirst seen 2026-08-31

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to read_until_whitespace with an input which does not have whitespace for a long time. Patches This has been fixed in pypdf==6.15.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #3947.

⚡ Watch CVE-2026-82398

Get an email if CVE-2026-82398 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumGHSA-fc8x-2rww-xw9m: pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespaceghsa · 2026-09-02
unknownCVE-2026-82398: pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craf…nvd · 2026-08-31

External references

NVD record for CVE-2026-82398

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-82398 status](https://www.csirts.com/badge/CVE-2026-82398)](https://www.csirts.com/cve/CVE-2026-82398)