CVE-2026-102996: pypdf: Possible large memory usage when parsing font data
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.18.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4072.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/font.py Font.collectttt1characterwidths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.18.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.18.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions earlier than 6.18.1 are affected when they process attacker-controlled PDFs containing a crafted TrueType or Type1 simple font. Text-extraction operations are specifically identified as an affected processing path.
What does an attacker need to do to trigger the issue?
An attacker needs to supply a crafted PDF with an unusually large /Widths array in a TrueType or Type1 simple font. No privileges or user interaction are required according to the supplied CVSS vector.
What is the impact of successful exploitation?
The malformed font data can cause pypdf to process width entries beyond the 256 character codes meaningful for a simple font, resulting in excessive memory consumption. This can affect availability of the process handling the PDF.
What is the recommended remediation?
Upgrade pypdf to version 6.18.1 or later, which contains the fix.