CVE-2026-59938

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a	Patch
https://github.com/py-pdf/pypdf/pull/3888	Issue Tracking Patch
https://github.com/py-pdf/pypdf/releases/tag/6.14.0	Product Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*

History

02 Nov 2026, 16:06

Type	Values Removed	Values Added
CPE	cpe:2.3:a:pypdf_project:pypdf::::::::	cpe:2.3:a:py-pdf:pypdf::::::::
First Time		Py-pdf pypdf Py-pdf

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la 6.14.0, un atacante puede elaborar un PDF con valores de tamaño de imagen declarados que son demasiado grandes en comparación con los datos reales, provocando un alto consumo de memoria en el análisis de imágenes de pypdf. Este problema se soluciona en la versión 6.14.0.

Information

Published : 2026-07-08 18:16

Updated : 2026-11-02 16:06

NVD link : CVE-2026-59938

Mitre link : CVE-2026-59938

CVE.ORG link : CVE-2026-59938

JSON object : View

Products Affected

py-pdf

pypdf

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-59938", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59938", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:58:08.413307Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "py-pdf", "product": "pypdf", "versions": [{"status": "affected", "version": "< 6.14.0"}]}]}], "published": "2026-07-08T18:16:35.097", "references": [{"url": "https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/py-pdf/pypdf/pull/3888", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/py-pdf/pypdf/releases/tag/6.14.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0."}, {"lang": "es", "value": "pypdf es una biblioteca PDF de Python puro, gratuita y de c\u00f3digo abierto. Antes de la 6.14.0, un atacante puede elaborar un PDF con valores de tama\u00f1o de imagen declarados que son demasiado grandes en comparaci\u00f3n con los datos reales, provocando un alto consumo de memoria en el an\u00e1lisis de im\u00e1genes de pypdf. Este problema se soluciona en la versi\u00f3n 6.14.0."}], "lastModified": "2026-11-02T16:06:04.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3127775-396D-45C6-9C41-EB2BD0841D64", "versionEndExcluding": "6.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}