py-pdf pypdf up to 6.7.0 Font /ToUnicode iteration

Summaryinfo

A vulnerability classified as problematic has been found in py-pdf pypdf up to 6.7.0. Affected by this issue is some unknown functionality of the component Font Handler. This manipulation of the argument /ToUnicode causes iteration. This vulnerability is tracked as CVE-2026-27025. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in py-pdf pypdf up to 6.7.0. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component Font Handler. The manipulation of the argument /ToUnicode with an unknown input leads to a iteration vulnerability. The CWE definition for the vulnerability is CWE-834. The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. As an impact it is known to affect availability. The summary by CVE is:

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-27025 since 02/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 299727 (Linux Distros Unpatched Vulnerability : CVE-2026-27025), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.7.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (299727) and CERT Bund (WID-SEC-2026-1730). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Xerox FreeFlow Print Server

Productinfo

Vendor

• py-pdf

Name

• pypdf

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7.0

License

• open-source

Website

• Product: https://github.com/py-pdf/pypdf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion