{"id":"CVE-2026-102993","published":"2026-09-30T20:17:27.630","lastModified":"2026-10-02T17:17:01.203","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-770"],"vendors":["pypdf project"],"products":["pypdf"],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4047","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.17.0","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4047","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.17.0","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285","tags":["Patch","Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"A crafted PDF file can cause pypdf to generate excessively large numeral strings when retrieving page labels, leading to high memory consumption and potential application unavailability. This vulnerability affects applications using pypdf to process PDFs.","exploitability":"Exploitation is relatively straightforward as it requires only a specially crafted PDF file that triggers large page label values, with no additional preconditions needed.","blast_radius":"The impact could be significant in environments where PDF processing is automated or frequently used, potentially causing denial of service across multiple applications relying on pypdf.","remediation":"Upgrade to pypdf version 6.17.0 or later to remediate this memory exhaustion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["memory-exhaustion","pdf-processing","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:08:33.523Z"}}