lopdf has a stack overflow via deeply nested PDF objects

影響: rust:lopdf < 0.42.0 → 0.42.0

lopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…

GitHub Advisory Databaseで読む

2026/10/17 04:55、GitHub Advisory Databaseが「lopdf has a stack overflow via deeply nested PDF objects」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Rust。