CVE-2026-71852CWE-834

CVE-2026-71852

Low · published August 7, 2026

CVSS v3.1

3.3

EPSS

Percentile

2.0

In the wild

Unconfirmed

What it is

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

The record

Technical detail

CVSS v3.1: 3.3 · LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00125 · 2.0th percentile
Weakness: CWE-834 · Excessive Iteration
Published: 2026-08-07T23:18Z

Affected products (1)

Product	Versions	Fixed in
pypdf_project/pypdf	< 6.15.0	6.15.0

References (4)

https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7 · [email protected]https://github.com/py-pdf/pypdf/pull/3946 · [email protected]https://github.com/py-pdf/pypdf/releases/tag/6.15.0 · [email protected]https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42 · [email protected]

EPSS history

Timeline

07 AUG 18:53Z
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
cvelistv5