CVE-2026-102995: pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

October 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

References

github.com/advisories/GHSA-fp3h-c4fm-7vvf
github.com/py-pdf/pypdf/commit/319d0b823ce2c311a2435e9fd93c13994d32bb51
github.com/py-pdf/pypdf/pull/4071
github.com/py-pdf/pypdf/releases/tag/6.18.1
github.com/py-pdf/pypdf/security/advisories/GHSA-fp3h-c4fm-7vvf
nvd.nist.gov/vuln/detail/CVE-2026-102995

Code Behaviors & Features

Detect and mitigate CVE-2026-102995 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →