CVE-2026-71852: pypdf: Possible long runtimes/large memory usage for large CID font width ranges
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.15.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3946.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3946](https://github.com/py-pdf/pypdf/pull/3946) to mitigate the long runtimes and large memory consumption caused by unusually large CID font /W width ranges or excessive width entries during text extraction.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71852?
CVE-2026-71852 is categorized with a risk score of 26.
What impact does CVE-2026-71852 have on applications?
CVE-2026-71852 allows an attacker to craft a malicious PDF that results in prolonged runtimes and excessive memory consumption.
How do I fix CVE-2026-71852?
To fix CVE-2026-71852, you should upgrade to pypdf version 6.15.0 or later.
Who is affected by CVE-2026-71852?
Users of the pypdf library are affected by CVE-2026-71852 if they do not update to the patched version.
What kind of attack is associated with CVE-2026-71852?
CVE-2026-71852 is associated with denial-of-service attacks that exploit large font width entries in PDF files.