CVE-2026-71852
Received Received - Intake

Memory Exhaustion in PyPDF PDF Text Extraction

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-71852
EUVD
EUVD-2026-54600

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
py_pdf pypdf to 6.15.0 (exc)
py_pdf pypdf 6.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the PyPDF library versions prior to 6.15.0. A crafted PDF file can cause excessive memory consumption and long processing times during text extraction. The issue occurs in the Font._collect_cid_character_widths function when handling unusually large CID font width ranges or excessive width entries.

Detection Guidance

Check if your pypdf version is below 6.15.0 using pip show pypdf. If vulnerable, update to 6.15.0 or later. Monitor system resources during PDF processing for unusual memory or CPU spikes.

Impact Analysis

The vulnerability can lead to system resource exhaustion, causing slow performance or crashes when processing malicious PDF files. It requires user interaction to exploit but no special privileges, primarily impacting system availability.

Mitigation Strategies

Upgrade pypdf to version 6.15.0 or later immediately. If upgrading is not possible, apply changes from PR #3946 manually. Avoid processing untrusted PDFs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71852. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart