CVE-2026-71852 in pypdf
Summary
by MITRE • 08/07/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in pypdf affects versions prior to 6.15.0 and represents a denial of service condition that can be triggered through crafted PDF files. This flaw exists within the Font._collect_cid_character_widths function located in the pypdf/_font.py module, which handles the extraction of character width information from CID fonts during PDF processing operations. The vulnerability manifests when maliciously constructed PDF documents contain unusually large CID font /W width ranges or excessive width entries that cause the parsing function to consume disproportionate computational resources.
The technical implementation of this vulnerability stems from inadequate input validation and resource management within the font processing pipeline. When pypdf encounters a PDF containing malformed CID font data, the _collect_cid_character_widths function attempts to process width ranges that can expand exponentially in memory usage. This occurs because the function does not implement proper bounds checking or resource limits on the size of width entries it processes during text extraction operations. The flaw allows an attacker to craft PDF files that force the library into processing massive data structures, leading to extended execution times and substantial memory consumption patterns.
From an operational perspective, this vulnerability creates significant risks for systems that process untrusted PDF documents through pypdf libraries. Applications using vulnerable versions may experience complete service unavailability when processing malicious PDF files, as the library consumes all available system resources during font width collection operations. This affects any software that relies on pypdf for PDF text extraction, document analysis, or content processing workflows. The impact extends beyond simple resource exhaustion to include potential system crashes, application hangs, and denial of service conditions that can affect business continuity.
The vulnerability aligns with CWE-400, which addresses uncontrolled resource consumption, and relates to ATT&CK technique T1499.004 for network denial of service attacks. Organizations using pypdf in production environments should immediately upgrade to version 6.15.0 or later to address this security issue. Mitigation strategies include implementing proper input validation at the application level, setting resource limits on PDF processing operations, and deploying sandboxed environments for PDF handling when possible. Additionally, organizations should consider implementing automated patch management processes to ensure timely deployment of security updates across all systems utilizing vulnerable library versions. The fix in version 6.15.0 includes enhanced bounds checking and memory management within the font processing function to prevent excessive resource consumption during parsing operations.