CVE-2026-102995

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in PyPDF via Oversized ToUnicode Tokens

Publication date: 2026-09-30

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102995

EUVD

EUVD-2026-90367

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.18.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in pypdf before version 6.18.1 allows a crafted PDF to insert extremely large tokens in a font /ToUnicode mapping. When parsing these tokens during operations like text extraction, the library consumes excessive memory due to oversized values in pypdf/_cmap.py's parse_bfchar function.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf in use. Run 'pip show pypdf' or 'pip list | grep pypdf' to verify if the installed version is below 6.18.1. If so, the system is vulnerable.

Impact Analysis

An attacker could exploit this to cause denial-of-service by crashing applications or consuming system resources when processing malicious PDFs. Users may experience slowdowns or crashes during PDF text extraction or similar operations.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through excessive memory consumption during PDF processing. Uncontrolled resource usage may lead to system instability or crashes, which could disrupt access to personal or sensitive data, violating availability requirements in these regulations.

Mitigation Strategies

Upgrade pypdf to version 6.18.1 or later using 'pip install --upgrade pypdf'. If upgrading is not possible, avoid processing untrusted PDF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-102995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70