CVE-2026-41313

CVE-2026-41313 is a denial-of-service vulnerability in pypdf versions prior to 6.10.2 that allows attackers to craft malicious PDF files capable of causing extended processing times. The vulnerability is triggered when loading PDFs with abnormally large trailer /Size values in incremental mode, affecting the open-source pypdf library used for PDF manipulation. The attack requires low complexity, as an attacker simply needs to create a specially crafted PDF file with an inflated /Size parameter. While the CVSS score is not available, the extremely low EPSS score of 0.00014 and FAUCET Risk Score of 31.0/100 indicate minimal practical severity. The primary impact is a potential denial-of-service condition through resource exhaustion rather than data compromise or unauthorized access. There is no evidence of active exploitation in the wild, as the vulnerability does not appear on the CISA Known Exploited Vulnerabilities list and remains inactive on security tracking lists. The fix has been available since pypdf version 6.10.2, and users can either upgrade or manually apply the provided patch as a temporary workaround.