CVE-2026-71852: pypdf excessive iteration in CID font width parsing

Executive brief

A vulnerability in the pypdf library, which is used to process PDF files in Python applications, can allow an attacker to cause significant delays or system crashes. By providing a specially crafted PDF file with unusual font settings, an attacker can force the application to consume excessive memory and processing time. This could lead to a denial-of-service, making the affected application unavailable to users.

Technical details

The pypdf library is vulnerable to excessive iteration (CWE-834) when parsing font width entries in CID fonts. An attacker can craft a PDF with unusually large values in these entries, which, when processed during operations like text extraction, leads to long runtimes and high memory usage. The vulnerability is triggered by a lack of sufficient limits on loops during font width parsing. This is a local attack vector requiring the user to process a malicious file (User Interaction: Passive). The issue is fixed in version 6.15.0.

Affected products

• py-pdf pypdf < 6.15.0

Timeline

• 2026-08-06: patched: Version 6.15.0 released.
• 2026-08-07: advisory: GitHub Advisory published.

References

• https://api.github.com/users/7thParkk
• https://github.com/7thParkk
• https://api.github.com/users/7thParkk/gists%7B/gist_id%7D
• https://api.github.com/users/7thParkk/repos
• https://avatars.githubusercontent.com/u/91473103?v=4
• https://api.github.com/users/7thParkk/events%7B/privacy%7D