Dashboard / CVE-2026-114610

CVE-2026-114610

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 63/100
Published: 2026-10-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: High

Description

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
py-pdf fpdf2 >= 2.5.0, < 2.8.8

References & Advisories (4)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.46%
Raw Score 0.004590
Percentile 39.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00459
2026-10-28
0.00305

Intelligence Sources

mitre ref →
nvd ref →

External Links