CVE-2026-27025: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-27025 Overview

CVE-2026-27025 is a resource exhaustion vulnerability affecting pypdf, a free and open-source pure-Python PDF library. Prior to version 6.7.1, an attacker can craft a malicious PDF document that leads to excessive runtime and memory consumption when parsed by the library. The vulnerability is triggered during text extraction when the library processes a /ToUnicode entry in a PDF font definition containing unusually large values.

Critical Impact

Applications using pypdf for PDF processing may experience denial of service conditions, including system unresponsiveness, memory exhaustion, and application crashes when processing maliciously crafted PDF files.

Affected Products

• pypdf versions prior to 6.7.1
• Applications and services using pypdf for PDF text extraction
• Python-based PDF processing pipelines incorporating the pypdf library

Discovery Timeline

• 2026-02-20 - CVE-2026-27025 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-27025

Vulnerability Analysis

This vulnerability (CWE-834: Excessive Iteration) allows attackers to cause denial of service through algorithmic complexity attacks. The pypdf library's character mapping (_cmap.py) module processes /ToUnicode entries in PDF font definitions without adequate size validation. When a maliciously crafted PDF contains a /ToUnicode entry with abnormally large values, the parsing routine enters computationally expensive operations, consuming excessive CPU time and memory resources.

The attack is particularly concerning in server-side PDF processing scenarios where untrusted PDF files are accepted and parsed automatically. Applications performing text extraction, content indexing, or PDF conversion are at elevated risk.

Root Cause

The root cause of CVE-2026-27025 lies in insufficient input validation within the pypdf character mapping module. The /ToUnicode CMap stream in PDF font definitions maps character codes to Unicode values, but the original implementation did not impose limits on the size of entries being processed. This allows specially crafted values to trigger excessive memory allocation and CPU-intensive parsing loops.

Attack Vector

The attack requires local access or the ability to submit a malicious PDF file to a vulnerable application. An attacker creates a PDF document with a specially crafted font definition containing a /ToUnicode entry with extremely large values. When the target application attempts to extract text from this PDF using pypdf, the library processes these oversized entries, leading to resource exhaustion. This can effectively deny service to legitimate users of the application.

# Security patch in pypdf/_cmap.py - Limiting /ToUnicode entry size
# Source: https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2

 
from ._codecs import adobe_glyphs, charset_encoding
from ._utils import logger_error, logger_warning
+from .errors import LimitReachedError
from .generic import (
    DecodedStreamObject,
    DictionaryObject,

The patch introduces a LimitReachedError exception to enforce size constraints on /ToUnicode entries during CMap parsing, preventing the resource exhaustion condition.

Detection Methods for CVE-2026-27025

Indicators of Compromise

• Unusual memory consumption spikes in Python processes handling PDF files
• Extended CPU utilization during PDF text extraction operations
• Application timeouts or unresponsiveness when processing specific PDF documents
• Log entries indicating memory allocation failures or resource limit errors

Detection Strategies

• Monitor pypdf-dependent applications for abnormal resource consumption patterns during PDF processing
• Implement input validation to inspect PDF /ToUnicode entries before full parsing
• Deploy resource quotas and timeout mechanisms for PDF processing operations
• Audit application dependencies and verify pypdf version is 6.7.1 or later

Monitoring Recommendations

• Establish baseline metrics for PDF processing operations and alert on significant deviations
• Implement centralized logging for PDF processing errors and timeouts
• Monitor container or process resource limits for services handling untrusted PDFs
• Configure alerting on LimitReachedError exceptions in upgraded pypdf installations

How to Mitigate CVE-2026-27025

Immediate Actions Required

• Upgrade pypdf to version 6.7.1 or later immediately
• Review all applications and services using pypdf as a dependency
• Implement resource limits (memory, CPU time) for PDF processing operations
• Consider temporarily disabling text extraction features until patching is complete

Patch Information

The vulnerability is fixed in pypdf version 6.7.1. The security patch introduces size limits for /ToUnicode entries and raises a LimitReachedError when malformed entries are detected. Upgrade instructions and release notes are available in the GitHub Release 6.7.1. Technical details of the fix can be reviewed in GitHub Pull Request 3646 and the associated security advisory.

Workarounds

• Implement timeout mechanisms for PDF parsing operations to prevent indefinite resource consumption
• Deploy PDF processing in isolated containers with strict memory and CPU limits
• Pre-screen PDF files using alternative tools before pypdf processing
• Temporarily disable or bypass /ToUnicode processing if text extraction is not required

# Configuration example - Upgrade pypdf to patched version
pip install --upgrade pypdf>=6.7.1

# Verify installed version
pip show pypdf | grep Version