Memory Consumption Issue in pypdf Library by PyPDF
CVE-2026-71870

4.8MEDIUM

Key Information:

Vendor

Py-PDF

Status
PyPDF
Vendor
CVE Published:
7 August 2026

What is CVE-2026-71870?

The pypdf library, an open-source pure-python PDF tool, is susceptible to a memory consumption vulnerability. Prior to version 6.15.0, an attacker could craft a malicious PDF where unusually large tokens in font or /ToUnicode CMap strings lead to excessive memory usage during the text extraction process. This issue can impact applications that rely on pypdf for handling PDF documents. To mitigate this vulnerability, users are advised to upgrade to version 6.15.0 or later.

Affected Version(s)

pypdf < 6.15.0

References

https://github.com/py-pdf/pypdf/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/py-pdf/pypdf/pull/3944
x_refsource_MISC
https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c2...
x_refsource_MISC

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.