CVE-2026-59938: pypdf: Possible large memory usage for wrong image dimensions
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.
Patches
This has been fixed in pypdf==6.14.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3888.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.14.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.14.0 - Compensating control
If you cannot upgrade yet, apply the workaround changes from PR [#3888] for pypdf image parsing to prevent large memory usage from PDFs with declared image dimensions that are much too large compared to the actual data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59938?
CVE-2026-59938 has a risk score of 28, indicating it has the potential for significant impact.
How do I fix CVE-2026-59938?
To fix CVE-2026-59938, upgrade to pypdf version 6.14.0 or later.
What types of attacks can exploit CVE-2026-59938?
CVE-2026-59938 can be exploited by crafting a PDF with unrealistic image size declarations leading to excessive memory usage.
In which versions is CVE-2026-59938 present?
CVE-2026-59938 is present in pypdf versions prior to 6.14.0.
What is pypdf in relation to CVE-2026-59938?
pypdf is a pure-Python PDF library that has a vulnerability allowing for large memory usage due to improper image size handling.