CVE-2026-71870: pypdf: Possible large memory usage for large /ToUnicode streams

August 7, 2026 (updated August 9, 2026)

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

References

github.com/advisories/GHSA-fp3f-mc75-235c
github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa
github.com/py-pdf/pypdf/pull/3944
github.com/py-pdf/pypdf/releases/tag/6.15.0
github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c
nvd.nist.gov/vuln/detail/CVE-2026-71870

Code Behaviors & Features

Detect and mitigate CVE-2026-71870 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →