Fluid Attacks Database

Description

pypdf: Possible large memory usage when parsing font data

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.18.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4072.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	pypdf	>=0 <6.18.1	6.18.1
debian 12	pypdf	=3.17.4-1 \|\| =3.4.1-1 \|\| =3.4.1-1+deb12u1 \|\| =4.0.0-1 \|\| =4.0.0-1~exp1 \|\| =4.0.1-1 \|\| =4.0.2-1 \|\| =4.1.0-1 \|\| =4.2.0-1 \|\| =4.3.1-1 \|\| =5.4.0-1 \|\| =6.19.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2	-
debian 13	pypdf	=5.4.0-1 \|\| =6.19.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2	-
debian 14	pypdf	=5.4.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2 \|\| >=0 <6.19.0-1	6.19.0-1

Aliases

1. CVE-2026-1029962. NVD-2026-1029963. OSV-2026-1029964. OSV-DEBIAN-2026-1029965. GHSA-g9cg-prrw-2r8q6. GCVE-2026-1029967. SECURITY-TRACKER-CVE-2026-102996

References

1. https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q2. https://github.com/py-pdf/pypdf/pull/40723. https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd54. https://github.com/py-pdf/pypdf/releases/tag/6.18.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.