RUSTSEC-2026-0187High· 7.5▾ TwilightStack overflow in lopdf via deeply nested PDF objects
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.
Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.
Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.
fn main() {
let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT
}
An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.
Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.
lopdf >= 0.0.0-0, < 0.42.0Upgrade to a patched release:
lopdf 0.42.0Connected by shared product, vendor, weakness, or advisory.