Fluid Attacks Database

Description

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3946.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	pypdf	>=0 <6.15.0	6.15.0

Aliases

1. CVE-2026-718522. NVD-2026-718523. OSV-2026-718524. GHSA-fwg2-594c-jp425. GCVE-2026-71852

References

1. https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp422. https://github.com/py-pdf/pypdf/pull/39463. https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d74. https://github.com/py-pdf/pypdf/releases/tag/6.15.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.