{"id":"CVE-2026-102996","published":"2026-09-30T21:17:06.863","lastModified":"2026-10-05T15:13:17.070","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":["pypdf project"],"products":["pypdf"],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4072","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q","tags":["Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4072","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q","tags":["Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"A memory exhaustion vulnerability in pypdf allows attackers to craft malicious PDFs with oversized font width arrays that cause excessive memory consumption during text extraction operations. This can lead to denial of service through resource exhaustion.","exploitability":"Exploitation is relatively straightforward as it requires only crafting a malicious PDF file with oversized font data, with no special preconditions needed for the target system.","blast_radius":"The impact could be significant across any application or service that processes PDF files using pypdf, particularly those handling untrusted PDF uploads or automated text extraction workflows.","remediation":"Upgrade to pypdf version 6.18.1 or later to remediate this memory exhaustion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["memory-exhaustion","pdf","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:07:31.521Z"}}