CVE-2026-103000: pypdf: Possible large memory usage when retrieving alphabetical page labels

Q: What conditions are required for exploitation?

An attacker needs to supply a crafted PDF containing unusually large alphabetical page-label values. The vulnerable application must retrieve the document's page labels; the issue is not described as occurring merely from opening or parsing a PDF.

Q: Which deployments are exposed?

Applications using pypdf versions earlier than 6.19.0 are affected if they process attacker-controlled PDFs and retrieve document page labels. No authentication, user interaction, or special attack conditions are required according to the provided CVSS vector.

Q: What is the impact of a successful attack?

Retrieving the crafted page labels can cause pypdf to generate excessively large strings and consume excessive memory. This can make the affected application unavailable.

Q: How can the issue be remediated?

Upgrade pypdf to version 6.19.0, which fixes the issue.

Published Sep 30, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/pagelabels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.

Affected Software

1 affected component

pypi/pypdf<6.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.19.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:13 PM

Data Sourced

via MITRE·08:13 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs to supply a crafted PDF containing unusually large alphabetical page-label values. The vulnerable application must retrieve the document's page labels; the issue is not described as occurring merely from opening or parsing a PDF.

Which deployments are exposed?

Applications using pypdf versions earlier than 6.19.0 are affected if they process attacker-controlled PDFs and retrieve document page labels. No authentication, user interaction, or special attack conditions are required according to the provided CVSS vector.

What is the impact of a successful attack?

Retrieving the crafted page labels can cause pypdf to generate excessively large strings and consume excessive memory. This can make the affected application unavailable.

How can the issue be remediated?

Upgrade pypdf to version 6.19.0, which fixes the issue.

CVE-2026-103000: pypdf: Possible large memory usage when retrieving alphabetical page labels

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are exposed?

What is the impact of a successful attack?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are exposed?

What is the impact of a successful attack?

How can the issue be remediated?