CVE-2026-102996 in pypdf
Summary
by MITRE • 10/01/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within the pypdf library, specifically affecting versions prior to 6.18.1, represents a significant resource exhaustion risk stemming from improper validation of font metrics in PDF documents. As an open-source pure-Python library designed for parsing and manipulating Portable Document Format files, pypdf is frequently utilized by applications that need to extract text or analyze document structure. The core technical flaw resides within the Font._collect_tt_t1_character_widths method located in the pypdf/_font.py module. This function is responsible for processing character width data for TrueType and Type1 simple fonts, which are standard font types defined in the PDF specification. Under normal circumstances, a simple font maps only 256 distinct character codes to their respective glyphs and widths. However, the vulnerability arises when an attacker crafts a malicious PDF document that includes a /Widths array containing significantly more entries than the expected limit of 256.
When pypdf processes such a crafted file, it fails to enforce strict bounds checking on the length of the /Widths array relative to the defined character codes for simple fonts. Consequently, the library attempts to iterate through and process all entries present in this oversized array rather than limiting its scope to the valid 256-character range. This lack of input validation leads directly to excessive memory consumption as the application allocates resources to handle data that is structurally invalid or irrelevant for a standard simple font operation. The impact is particularly severe during operations such as text extraction, where the library must parse and store these width values to reconstruct the visual layout of the document. An attacker can exploit this behavior by embedding a specially constructed PDF into an email attachment, a web upload form, or any other vector that triggers pypdf to process the file automatically.
The operational impact of this vulnerability is primarily categorized as a Denial of Service (DoS) due to resource exhaustion. By triggering the excessive memory allocation described above, an attacker can cause the hosting application to consume all available system memory, leading to performance degradation or complete crash of the service running pypdf. In environments where PDF processing is handled asynchronously or in bulk, such as document management systems or automated content analysis pipelines, this vulnerability could be leveraged to disrupt critical business operations. The attack does not require code execution but relies on the application's willingness to process untrusted input without sufficient sanitization of structural metadata. This aligns with CWE-789, which describes memory allocation with an incorrect limit, and falls under the ATT&CK technique T1496, Resource Hijacking, specifically within the context of resource exhaustion via denial of service.
To mitigate this risk, organizations relying on pypdf must immediately upgrade to version 6.18.1 or later, where the developers have implemented proper validation logic to ensure that only valid character code ranges are processed for simple fonts. For applications unable to update instantly due to dependency constraints, implementing a preprocessing step that validates PDF structure before passing it to pypdf can provide temporary relief. This includes checking the length of font arrays against expected limits defined by the PDF specification. Additionally, deploying resource monitoring and limiting memory usage per process through containerization or OS-level controls can help contain the impact if an exploit is attempted. Regular security audits of third-party dependencies are essential to maintain resilience against such input validation flaws in widely used libraries like pypdf.