CVE-2026-71852: pypdf: Possible long runtimes/large memory usage for large CID font width ranges

August 7, 2026

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

References

github.com/advisories/GHSA-fwg2-594c-jp42
github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7
github.com/py-pdf/pypdf/pull/3946
github.com/py-pdf/pypdf/releases/tag/6.15.0
github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42
nvd.nist.gov/vuln/detail/CVE-2026-71852

Code Behaviors & Features

Detect and mitigate CVE-2026-71852 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →