CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.
Patches
This has been fixed in pypdf==6.17.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4047.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.17.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.17.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4047.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using pypdf before 6.17.0 are exposed if they retrieve page labels from attacker-controlled or otherwise untrusted PDF documents. The impact is excessive memory consumption that can make the application unavailable.
What must an attacker do to trigger the problem?
An attacker needs to supply a crafted PDF containing unusually large Roman page-label values. The application must then retrieve the document's page labels for pypdf to generate the excessively large numeral strings.
Is a workaround available if updating is delayed?
The provided information identifies upgrading to pypdf 6.17.0 as the fix. It does not specify an alternative workaround; reducing or avoiding retrieval of page labels from untrusted PDFs may limit exposure, but this is not stated as a supported mitigation.