CVE-2026-71870

Received Received - Intake

Memory Exhaustion in PyPDF Text Extraction

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-71870

EUVD

EUVD-2026-54615

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	6.15.0
py-pdf	pypdf	to 6.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-71870 is a vulnerability in the pypdf library affecting versions prior to 6.15.0. It involves uncontrolled memory consumption when parsing large tokens in a font /ToUnicode CMap during text extraction. An attacker can craft a PDF with unusually large source-code or destination-string tokens to cause excessive memory usage.

Detection Guidance

Check if your pypdf version is below 6.15.0 by running: pip show pypdf. If vulnerable, update to 6.15.0 or later. Monitor system memory during PDF text extraction for unusual spikes.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive system memory when processing malicious PDF files. It may cause applications using pypdf to slow down or crash during text extraction operations.

Compliance Impact

This vulnerability primarily causes uncontrolled memory consumption during PDF text extraction, which could lead to denial-of-service conditions. It does not directly impact data confidentiality or integrity, so it likely has minimal direct effect on compliance with GDPR or HIPAA. However, service disruption from resource exhaustion could indirectly affect availability requirements in these standards.

Mitigation Strategies

Upgrade pypdf to version 6.15.0 or later using pip install --upgrade pypdf. If immediate upgrade is not possible, apply changes from pull request #3944 manually.

Hi! I’m here to help you understand CVE-2026-71870. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70