CVE-2026-102996: pypdf: Possible large memory usage when parsing font data
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/font.py Font.collectttt1characterwidths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.18.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions earlier than 6.18.1 are affected when they process attacker-controlled PDFs containing a crafted TrueType or Type1 simple font. Text-extraction operations are specifically identified as an affected processing path.
What does an attacker need to do to trigger the issue?
An attacker needs to supply a crafted PDF with an unusually large /Widths array in a TrueType or Type1 simple font. No privileges or user interaction are required according to the supplied CVSS vector.
What is the impact of successful exploitation?
The malformed font data can cause pypdf to process width entries beyond the 256 character codes meaningful for a simple font, resulting in excessive memory consumption. This can affect availability of the process handling the PDF.
What is the recommended remediation?
Upgrade pypdf to version 6.18.1 or later, which contains the fix.