Cyber Posture

CVE-2026-27888

High

Published: 26 February 2026

Published
26 February 2026
Modified
27 February 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0006 17.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27888 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Pypdf Project Pypdf. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-400

Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.

addresses: CWE-400

Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts.

addresses: CWE-400

Contingency plan testing includes resource exhaustion scenarios to verify recovery, making it harder for attackers to sustain exploits that cause uncontrolled consumption.

addresses: CWE-400

Updated contingency plans include current procedures to detect, contain, and recover from resource exhaustion, limiting an attacker's ability to sustain impact from uncontrolled consumption.

addresses: CWE-400

Alternate site allows resumption of operations if resource exhaustion at the primary site is exploited to cause unavailability.

addresses: CWE-400

Alternate telecommunications services enable resumption of essential functions when primary services become unavailable due to uncontrolled resource consumption.

addresses: CWE-400

The team can analyze and respond to resource exhaustion incidents, reducing the impact of attacks that exploit uncontrolled consumption weaknesses.

addresses: CWE-400

Timely maintenance support and spare parts enable rapid recovery from failures induced by uncontrolled resource consumption, shortening the impact window of denial-of-service attacks.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

CVE describes remote (AV:N) exploitation of a public-facing application/library via malicious PDF input to trigger application-level resource exhaustion DoS (CWE-400).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer…

more

and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

Deeper analysisAI

CVE-2026-27888 is a denial-of-service vulnerability in pypdf, a free and open-source pure-Python PDF library. Versions prior to 6.7.3 are affected, where accessing the `xfa` property of a reader or writer object on a PDF with a stream compressed using `/FlateDecode` can lead to RAM exhaustion. The issue is classified under CWE-400 (Uncontrolled Resource Consumption) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

An unauthenticated attacker (PR:N) can exploit this remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N) by crafting a malicious PDF file. Upon processing the file and accessing the vulnerable `xfa` property, the library exhausts available RAM, resulting in high-impact availability disruption (A:H) without affecting confidentiality or integrity.

The vulnerability has been fixed in pypdf version 6.7.3. Mitigation involves upgrading to this version, with a manual patch available as a workaround. Relevant advisories and resources include the GitHub security advisory (GHSA-x7hp-r3qg-r3cj), the fixing commit (7a4c8246ed48d9d328fb596942271da47b6d109c), pull request #3658, and the release notes for v6.7.3.

Details

CWE(s)

Affected Products

pypdf project
pypdf
≤ 6.7.3

CVEs Like This One

CVE-2026-33699Same product: Pypdf Project Pypdf
CVE-2026-27628Same product: Pypdf Project Pypdf
CVE-2025-24269Shared CWE-400
CVE-2025-65890Shared CWE-400
CVE-2025-27669Shared CWE-400
CVE-2024-54730Shared CWE-400
CVE-2025-9282Shared CWE-400
CVE-2025-70886Shared CWE-400
CVE-2025-20058Shared CWE-400
CVE-2025-21547Shared CWE-400

References