CVE-2026-54651

mediumcovered by 1 sourcefirst seen 2026-07-09

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR #3839.

⚡ Watch CVE-2026-54651

Get an email if CVE-2026-54651 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumGHSA-g9xf-7f8q-9mcj: pypdf: Possible infinite loop when processing threads/articles in writerghsa · 2026-07-09

External references

NVD record for CVE-2026-54651

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54651 status](https://www.csirts.com/badge/CVE-2026-54651)](https://www.csirts.com/cve/CVE-2026-54651)