CVE-2026-102995
published 2026-09-30CVE-2026-102995: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
26.8th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform | automation-orchestrator-backend-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.18.1 | 6.18.1 |
| pypdf_project | pypdf | < 6.18.1 | 6.18.1 |
| pypdf_project | pypdf | >= 0 < 6.18.1 | 6.18.1 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
ghsa·2026-10-01
CVE-2026-102995 [HIGH] CWE-400 pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction.
### Patches
This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4071](https://github.com/py-pdf/pypdf/pull/4071).
VulDB
py-pdf pypdf up to 6.18.0 ToUnicode Mapping pypdf/_cmap.py parse_bfchar memory allocation
vuldb·2026-09-30·CVSS 8.7
CVE-2026-102995 [HIGH] py-pdf pypdf up to 6.18.0 ToUnicode Mapping pypdf/_cmap.py parse_bfchar memory allocation
A vulnerability was found in py-pdf pypdf up to 6.18.0. It has been rated as problematic. This affects the function parse_bfchar of the file pypdf/_cmap.py of the component ToUnicode Mapping. This manipulation causes uncontrolled memory allocation.
This vulnerability is tracked as CVE-2026-102995. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
pypdf: pypdf: Denial of Service via excessive memory consumption in font mapping
vendor_redhat·2026-09-30·CVSS 8.7
CVE-2026-102995 [HIGH] CWE-770 pypdf: pypdf: Denial of Service via excessive memory consumption in font mapping
pypdf: pypdf: Denial of Service via excessive memory consumption in font mapping
A flaw was found in pypdf. A remote attacker could exploit this vulnerability by submitting a specially crafted PDF document containing unusually large tokens in font mapping streams. When the library parses this data during operations such as text extraction, it decodes and retains oversized values, leading to excessive memory consumption and a Denial of Service (DoS).
Package: ansible-automation-platform/automation-orchestrator-backend-rhel9 (Ansible Automation Orchestrator 2026) - Fix deferred
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lig
No detection rules found.
No public exploits indexed.
2026-09-30
Published