CVE-2026-27025: pypdf has possible long runtimes/large memory usage for large /ToUnicode streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.7.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3646.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.7.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.7.1 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3646] (py-pdf/pypdf/pull/3646) to mitigate long runtimes/large memory consumption triggered by large /ToUnicode font values.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27025?
CVE-2026-27025 is considered a moderate severity vulnerability due to the potential for long runtimes and large memory usage.
How do I fix CVE-2026-27025?
To fix CVE-2026-27025, upgrade pypdf to version 6.7.1 or later.
What does CVE-2026-27025 affect?
CVE-2026-27025 affects the pypdf library, specifically related to handling large /ToUnicode streams in PDFs.
Can CVE-2026-27025 lead to denial of service?
Yes, CVE-2026-27025 can result in denial of service due to the excessive memory consumption and long processing times.
Who can exploit CVE-2026-27025?
An attacker who crafts a specially formatted PDF can exploit CVE-2026-27025.