CVE-2026-102996
published 2026-09-30CVE-2026-102996: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
26.8th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform | automation-orchestrator-backend-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.18.1 | 6.18.1 |
| pypdf_project | pypdf | < 6.18.1 | 6.18.1 |
| pypdf_project | pypdf | >= 0 < 6.18.1 | 6.18.1 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Possible large memory usage when parsing font data
ghsa·2026-10-01
CVE-2026-102996 [HIGH] CWE-400 pypdf: Possible large memory usage when parsing font data
pypdf: Possible large memory usage when parsing font data
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/Widths` entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.
### Patches
This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4072](https://github.com/py-pdf/pypdf/pull/4072).
VulDB
py-pdf pypdf up to 6.18.0 Font Width Collection pypdf/_font.py Font._collect_tt_t1_character_widths memory allocation
vuldb·2026-09-30·CVSS 8.7
CVE-2026-102996 [HIGH] py-pdf pypdf up to 6.18.0 Font Width Collection pypdf/_font.py Font._collect_tt_t1_character_widths memory allocation
A vulnerability categorized as problematic has been discovered in py-pdf pypdf up to 6.18.0. This vulnerability affects the function Font._collect_tt_t1_character_widths of the file pypdf/_font.py of the component Font Width Collection. Such manipulation leads to uncontrolled memory allocation.
This vulnerability is listed as CVE-2026-102996. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
Red Hat
pypdf: pypdf: Denial of Service via excessive memory consumption during font parsing
vendor_redhat·2026-09-30·CVSS 8.7
CVE-2026-102996 [HIGH] CWE-770 pypdf: pypdf: Denial of Service via excessive memory consumption during font parsing
pypdf: pypdf: Denial of Service via excessive memory consumption during font parsing
A flaw was found in pypdf. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a specially crafted PDF document with an oversized font character width array. When processing the document during operations such as text extraction, the library allocates excessive memory, leading to resource exhaustion and potential application failure.
Package: ansible-automation-platform/automation-orchestrator-backend-rhel9 (Ansible Automation Orchestrator 2026) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Cor
No detection rules found.
No public exploits indexed.
2026-09-30
Published