Skip to content

Possible large memory usage for large /ToUnicode streams (Follow-up)

Moderate
stefan6419846 published GHSA-fp3f-mc75-235c Aug 6, 2026

Package

pip pypdf (pip)

Affected versions

< 6.15.0

Patched versions

>= 6.15.0

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3944.

Severity

Moderate

CVE ID

CVE-2026-71870

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource. Learn more on MITRE.

Credits