joakimbulow/cve-2026-24688Proof-of-concept exploit for CVE-2026-24688, a denial-of-service vulnerability in pypdf's outline parsing. Includes malicious PDF generator and reproduction scripts demonstrating memory exhaustion and system crash.
This repo includes proof of concept code for triggering CVE-2026-24688.
Critical Denial of Service vulnerability in pypdf's outline (bookmark) parsing logic. When processing a PDF with circular outline references, the parser enters an infinite loop that continuously allocates memory, consuming hundreds of MBs memory per seconds, on my machine (TM), and lead to complete system crash.
This is a system-level DoS, not just an application hang.
malicious_circular_outline.pdf - Exploit PDF with circular outline (754 bytes)create_malicious_pdf.py - Script to generate the exploit PDFsimple_read_pdf.py - Simple test script to reproduce the vulnerabilitytest_pypdf.sh - Automated test script (installs pypdf and runs test)README.md - This fileWARNING: These tests may crash your system if you dont keep an eye on memory consumption and cancel it in time.
# Run the automated test script (with timeout protection)
chmod +x test_pypdf.sh
./test_pypdf.sh
# This will:
# 1. Install the vulnerable version of pypdf
# 2. Run test with 15-second timeout
# 3. Show memory consumption behavior
# Install pypdf (vulnerable version 6.6.0)
pip install "pypdf==6.6.0"
# Run with timeout
timeout 10s python3 simple_read_pdf.py malicious_circular_outline.pdf
# Install pypdf (vulnerable version 6.6.0)
pip install "pypdf==6.6.0"
# Run without timeout
python3 simple_read_pdf.py malicious_circular_outline.pdf
def _get_outline(self, node, outline=None):
while True: # ❌ NO cycle detection!
outline_obj = self._build_outline_item(node)
if outline_obj:
outline.append(outline_obj) # ❌ Heap allocation in loop!
if "/Next" not in node:
break
node = node["/Next"] # ❌ Follows circular references
Root Cause: No visited set, no iteration limit, continuous memory allocation
Real-World Test:
Attack Characteristics:
Fixed in version 6.6.2