CVE-2026-71852
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.
Risk Assessment
The risk is a denial of service attack on applications using pypdf by sending a malicious PDF, potentially leading to resource exhaustion.
Recommendation
Upgrade pypdf to version 6.15.0 or later and validate processed PDF files.
Original NVD description (English source)
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.