Read the docs
TI-2026-76192 Aliases GHSA-6fj4-rcr3-r7rr

Stack overflow in lopdf via deeply nested PDF objects

Priority LOW 38CWE-1124Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

lopdf, a Rust library for reading PDF files, is affected before 0.42.0. Its object parser recurses without a depth limit when it reads nested PDF arrays and dictionaries, which is classified as CWE-1124 (Excessively Deep Nesting). A small crafted PDF with thousands of nested array levels in the Catalog exhausts the call stack and aborts the process, which cannot be caught with catch_unwind. An attacker who can supply a PDF to a service that parses it with lopdf can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the GitHub advisory

`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`. Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service. Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed. ## Proof of concept ```rust fn main() { let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT } ``` An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`. ## Suggested fix Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.

Why it matters now

Fix Fixed lopdf (crates.io): 0.42.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—lopdf (crates.io)before 0.42.00.42.0Patch availableGHSA-6fj4-rcr3-r7rr
  • lopdf (crates.io) Vendor— Affected before 0.42.0 Fixed in 0.42.0 Patch available GHSA-6fj4-rcr3-r7rr

Remediation

Upgrade lopdf to 0.42.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · GHSA-6fj4-rcr3-r7rr lopdf (crates.io) Fixed in 0.42.0 Advisory →

Timeline

  1. 2026-10-18 Threatist record created from GHSA-6fj4-rcr3-r7rr

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences