CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels

Q: Which applications are exposed to this issue?

Applications using pypdf before 6.17.0 are exposed if they retrieve page labels from attacker-controlled or otherwise untrusted PDF documents. The impact is excessive memory consumption that can make the application unavailable.

Q: What must an attacker do to trigger the problem?

An attacker needs to supply a crafted PDF containing unusually large Roman page-label values. The application must then retrieve the document's page labels for pypdf to generate the excessively large numeral strings.

Q: Is a workaround available if updating is delayed?

The provided information identifies upgrading to pypdf 6.17.0 as the fix. It does not specify an alternative workaround; reducing or avoiding retrieval of page labels from untrusted PDFs may limit exposure, but this is not stated as a supported mitigation.

Published Sep 30, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

Affected Software

1 affected component

pypi/pypdf<6.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.17.0

Event History

Sep 30, 2026

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using pypdf before 6.17.0 are exposed if they retrieve page labels from attacker-controlled or otherwise untrusted PDF documents. The impact is excessive memory consumption that can make the application unavailable.

What must an attacker do to trigger the problem?

An attacker needs to supply a crafted PDF containing unusually large Roman page-label values. The application must then retrieve the document's page labels for pypdf to generate the excessively large numeral strings.

Is a workaround available if updating is delayed?

The provided information identifies upgrading to pypdf 6.17.0 as the fix. It does not specify an alternative workaround; reducing or avoiding retrieval of page labels from untrusted PDFs may limit exposure, but this is not stated as a supported mitigation.

CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to trigger the problem?

Is a workaround available if updating is delayed?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to trigger the problem?

Is a workaround available if updating is delayed?