CVE-2026-71870: pypdf: Possible large memory usage for large /ToUnicode streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.15.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3944.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3944] referenced in the material.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71870?
CVE-2026-71870 has a risk rating of 26.
What is CVE-2026-71870 about?
CVE-2026-71870 involves possible large memory usage caused by parsing large /ToUnicode streams in PDF files.
How do I fix CVE-2026-71870?
To fix CVE-2026-71870, upgrade to pypdf version 6.15.0 or later.
Can CVE-2026-71870 lead to a denial of service?
Yes, CVE-2026-71870 can cause excessive memory consumption, potentially leading to denial of service.
Who is affected by CVE-2026-71870?
Users of pypdf versions prior to 6.15.0 are affected by CVE-2026-71870.