CVE-2026-102996

Received Received - Intake

Memory Exhaustion in PyPDF Due to Excessive Font Widths

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102996

EUVD

EUVD-2026-90368

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.18.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the pypdf library before version 6.18.1. A crafted PDF can include a TrueType or Type1 font with an abnormally large /Widths array. When processed, this causes excessive memory consumption in the Font._collect_tt_t1_character_widths function during operations like text extraction.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf installed in your Python environment. Run 'pip show pypdf' or 'pip list | grep pypdf' to check the installed version. If the version is below 6.18.1, the system is vulnerable.

Impact Analysis

An attacker could exploit this to cause denial-of-service by consuming excessive system memory when processing malicious PDFs. This may lead to application crashes or degraded performance on systems using vulnerable versions of pypdf.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by enabling denial-of-service attacks through excessive memory consumption during PDF processing. Organizations handling sensitive data (e.g., personal health information under HIPAA) may face disruptions in operations if attackers exploit this flaw to crash systems.

Mitigation Strategies

Upgrade pypdf to version 6.18.1 or later immediately. Use 'pip install --upgrade pypdf' to update. If upgrading is not possible, avoid processing untrusted PDF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-102996. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70