OFFLINE
Awaiting data
Security intelligence
MajorCritical vulnerability

lopdf has a stack overflow via deeply nested PDF objects

GitHub Advisories · officialPublished Oct 16, 2026Risk 37/100

`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`. Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service. Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed. ## Proof of concept ```rust fn main() { let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT } ``` An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`. ## Suggested fix Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.

Upgrade affected packages to a patched version: lopdf 0.42.0.

Vendor
Not specified
Product
lopdf
Exploitation
none known
Evidence
official
CVSS
7.5

This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source