CVE-2026-102996

EUVD-2026-90368
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.96%
Affected Products (NVD)
VendorProductVersion
py-pdfpypdf
𝑥
< 6.18.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pypdf
bookworm
3.4.1-1+deb12u1
fixed
forky
6.21.4-1
fixed
sid
7.0.1-1
fixed
trixie
no-dsa
pypdf2
bookworm
2.12.1-3+deb12u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pypdf
jammy
dne
noble
needs-triage
resolute
needs-triage
pypdf2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5
https://github.com/py-pdf/pypdf/pull/4072
https://github.com/py-pdf/pypdf/releases/tag/6.18.1
https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q