CVE-2026-84309

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insert_child is involved.

Patches

This has been fixed in pypdf==6.16.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3964.