CVE-2026-102996 pypdf: Possible large memory usage when parsing font data

High 8.7 Published 30 Sep 2026 Updated 30 Sep 2026

A crafted PDF with an oversized font widths array causes excessive memory consumption in pypdf, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-102996?

CVE-2026-102996 is a high-severity denial of service vulnerability in Pypdf Project Pypdf, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.

Weakness: CWE-400

Which versions are affected by CVE-2026-102996?

3 open source packages ship an affected version, including pypdf. It affects 1 product.

Package	Affected	Fixed in
`pypdf` PyPI	All versions	`6.18.1`
`pypdf` PyPI	All versions	`6.18.1`
`pypdf` PyPI	All versions	`6.18.1`

Products include Pypdf Project Pypdf.

How do I fix CVE-2026-102996?

Upgrade pypdf to 6.18.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-102996 being exploited?

There is no known exploitation of CVE-2026-102996 in the wild and no public exploit code.

All Pypdf Project Pypdf vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-102996, ECHO-585f-b535-d99c, GHSA-g9cg-prrw-2r8q, MINI-446f-4xc3-mmfw, MINI-4hf7-gh35-h7f9, MINI-56f4-5q8f-jgwf and 14 more.