CVE-2026-102996 py-pdf CVE debrief

Who should care

Defenders responsible for systems that use the pypdf library should assess exposure and prioritize updating to version 6.18.1 or later. They should also review PDF processing workflows for potential exposure and monitor for suspicious PDF activity. Defenders should verify affected versions and remediate as necessary.

Why it matters

CVE-2026-102996 is a vulnerability in the pypdf library that can cause excessive memory consumption during PDF operations. Defenders should prioritize updating to version 6.18.1 or later to prevent this issue.

• Excessive memory consumption during PDF operations
• Potential for denial-of-service (DoS) attacks
• Need for verification of affected versions and remediation

Technical summary

The vulnerability is caused by a crafted PDF that can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1. Defenders should prioritize updating to version 6.18.1 or later to prevent excessive memory consumption during PDF operations. The vulnerability can cause excessive memory consumption during PDF operations, and defenders should review PDF processing workflows for potential exposure.

Defensive priority

Defenders should prioritize updating to version 6.18.1 or later to prevent excessive memory consumption during PDF operations.

Recommended defensive actions

• Update to version 6.18.1 or later
• Review PDF processing workflows for potential exposure
• Monitor for suspicious PDF activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a crafted PDF that can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font. The issue is fixed in version 6.18.1. Defenders should verify affected versions and remediate as necessary. The CVE record was published on 2026-09-30T21:17:06.863Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.