Executive brief
A vulnerability in the pypdf library, a tool used by developers to process and extract text from PDF files, could allow a specially crafted document to crash applications by consuming excessive memory. This could lead to service interruptions or system instability when the software attempts to process a malicious file. Organizations using this library for automated document processing should update to the latest version to prevent potential denial-of-service attacks.
Technical details
A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in pypdf versions prior to 6.15.0. The issue occurs when the library parses the /ToUnicode entry of a font containing unusually large values, typically during text extraction processes. An attacker can exploit this by providing a maliciously crafted PDF file that, when processed, causes the application to consume excessive amounts of memory. This is a local attack requiring passive user interaction (opening or processing the file). The vulnerability has been patched in version 6.15.0.
Affected products
- py-pdf pypdf < 6.15.0
Timeline
- 2026-08-06: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched: Fixed in version 6.15.0