Stack overflow in lopdf via deeply nested PDF objects
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
lopdf, a Rust library for reading PDF files, is affected before 0.42.0. Its object parser recurses without a depth limit when it reads nested PDF arrays and dictionaries, which is classified as CWE-1124 (Excessively Deep Nesting). A small crafted PDF with thousands of nested array levels in the Catalog exhausts the call stack and aborts the process, which cannot be caught with catch_unwind. An attacker who can supply a PDF to a service that parses it with lopdf can cause a denial of service.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the GitHub advisory
`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`. Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service. Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed. ## Proof of concept ```rust fn main() { let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT } ``` An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`. ## Suggested fix Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | lopdf (crates.io) | before 0.42.0 | 0.42.0 | Patch available | GHSA-6fj4-rcr3-r7rr |
- lopdf (crates.io) Vendor— Affected before 0.42.0 Fixed in 0.42.0 Patch available GHSA-6fj4-rcr3-r7rr
Remediation
Upgrade lopdf to 0.42.0, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · GHSA-6fj4-rcr3-r7rr lopdf (crates.io) Fixed in 0.42.0 Advisory →
Timeline
- 2026-10-18 Threatist record created from GHSA-6fj4-rcr3-r7rr
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences