CVE-2026-71852: pypdf Library DoS Vulnerability

CVE-2026-71852 Overview

CVE-2026-71852 is a denial-of-service vulnerability in pypdf, a widely used pure-Python PDF library. Versions prior to 6.15.0 mishandle unusually large CID font /W width ranges during text extraction. A crafted PDF can force the Font._collect_cid_character_widths function in pypdf/_font.py to consume excessive CPU time and memory. The issue is classified as an uncontrolled loop with unreachable exit condition [CWE-834] and is fixed in version 6.15.0.

Critical Impact
Applications performing automated text extraction on untrusted PDFs may hang or exhaust memory, disrupting document processing pipelines and downstream services.

Affected Products

pypdf versions prior to 6.15.0
Python applications invoking pypdf text extraction on untrusted PDF input
Automated document processing pipelines that ingest external PDFs using pypdf

Discovery Timeline

2026-08-07 - CVE-2026-71852 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71852

Vulnerability Analysis

The vulnerability resides in pypdf/_font.py within the Font._collect_cid_character_widths function. This routine parses the /W array of a CID (Character Identifier) font, which encodes glyph width information. The /W array supports two forms: a start-end range with a single width, and a start CID followed by an array of individual widths. Both forms rely on attacker-controlled integers in the PDF stream.

When pypdf encounters a /W entry with an extremely wide numeric range or an excessively long list of width entries, it iterates over each declared CID and records width metadata. The loop trusts the numeric bounds declared inside the PDF without enforcing a sanity cap. Parsing a PDF that declares billions of width entries drives CPU utilization to sustained peaks and inflates memory usage proportionally to the declared range size.

Root Cause

The root cause is an uncontrolled iteration bound sourced from attacker-supplied PDF metadata [CWE-834]. Font._collect_cid_character_widths did not validate the range size or entry count against document reasonableness before expanding the width table into memory. The fix in pypdf 6.15.0 introduces bounds enforcement so that malformed or malicious /W structures are rejected before allocation.

Attack Vector

Exploitation requires an attacker to deliver a crafted PDF to a system that runs pypdf text extraction. The CVSS metrics indicate a local attack vector with user interaction, consistent with a victim opening or processing a supplied file. No authentication is required, and the impact is limited to availability of the parsing process. Server-side services that accept PDF uploads and call pypdf extraction functions are the most exposed deployment pattern.

No public proof-of-concept exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-fwg2-594c-jp42 and the pypdf pull request discussion.

Detection Methods for CVE-2026-71852

Indicators of Compromise

Python worker processes running pypdf that remain in a R (running) state for extended periods while parsing a single PDF
Sudden resident memory growth in pypdf-based extraction services correlated with a specific inbound PDF
Repeated timeouts or OOM-killer terminations of PDF processing workers after receiving user-uploaded documents

Detection Strategies

Instrument PDF processing services with per-file CPU and wall-clock timers, and alert when extraction of a single document exceeds baseline thresholds
Inspect PDF objects for CID font /W arrays containing implausibly large numeric ranges before invoking pypdf extraction
Track the installed pypdf version across build artifacts and container images, flagging any release below 6.15.0

Monitoring Recommendations

Log memory high-water marks and execution duration for each PDF parsed by document pipelines
Forward host-level OOM and cgroup termination events to the SIEM for correlation with document upload activity
Monitor container restart loops on workers that ingest untrusted PDFs, as repeated crashes may indicate active abuse

How to Mitigate CVE-2026-71852

Immediate Actions Required

Upgrade pypdf to version 6.15.0 or later in all environments performing text extraction
Audit dependency manifests such as requirements.txt, pyproject.toml, and lockfiles to identify transitive pins on vulnerable pypdf versions
Rebuild and redeploy container images that bundle pypdf so the patched wheel is present at runtime

Patch Information

The fix is delivered in pypdf release 6.15.0 and applied by commit 51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7. The patch enforces bounds on CID font /W range expansion inside Font._collect_cid_character_widths so oversized declarations no longer trigger runaway allocation.

Workarounds

Enforce a hard timeout and memory ceiling around pypdf extraction calls using process supervisors or resource limits
Reject PDFs above a defined file-size threshold before submitting them to pypdf extraction routines
Isolate PDF parsing in a sandboxed worker or short-lived container so a hung extraction cannot degrade the host application

bash

# Configuration example
pip install --upgrade 'pypdf>=6.15.0'
pip show pypdf | grep -i version