CVE-2026-102993
Received Received - Intake

Integer Overflow in PyPDF Page Label Handling

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-01
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102993
EUVD
EUVD-2026-90365

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
py-pdf pypdf to 6.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the pypdf library versions before 6.17.0. An attacker can craft a PDF with unusually large Roman page-label values. When the application retrieves these page labels, pypdf generates excessively large numeral strings, consuming large amounts of memory and potentially making the application unavailable.

Detection Guidance

To detect this vulnerability, check the version of pypdf installed in your system using the command: pip show pypdf. If the version is below 6.17.0, the system is vulnerable. Additionally, inspect PDF files processed by your application for unusually large Roman page labels.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive memory when processing malicious PDFs. Applications using affected pypdf versions may become unresponsive or crash when handling such files.

Mitigation Strategies

Upgrade pypdf to version 6.17.0 or later immediately using the command: pip install --upgrade pypdf. If immediate upgrade is not possible, apply the temporary workaround from pull request #4047 as a short-term fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102993. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart