CVE-2026-71870

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-71870
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa Patch
https://github.com/py-pdf/pypdf/pull/3944 Patch
https://github.com/py-pdf/pypdf/releases/tag/6.15.0 Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*
History

02 Nov 2026, 16:06

Type Values Removed Values Added
First Time Py-pdf pypdf
Py-pdf
CPE cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*

23 Oct 2026, 20:10

Type Values Removed Values Added
Summary
  • (es) pypdf es una biblioteca PDF gratuita y de código abierto escrita íntegramente en Python. Antes de la versión 6.15.0, un PDF manipulado puede causar un consumo elevado de memoria cuando la función parse_bfrange de pypdf/_cmap.py analiza tokens de código fuente o de cadena de destino inusualmente grandes en un CMap /ToUnicode de una fuente durante la extracción de texto. Este problema está solucionado en la versión 6.15.0.

05 Oct 2026, 17:41

Type Values Removed Values Added
References () https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa - () https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa - Patch
References () https://github.com/py-pdf/pypdf/pull/3944 - () https://github.com/py-pdf/pypdf/pull/3944 - Patch
References () https://github.com/py-pdf/pypdf/releases/tag/6.15.0 - () https://github.com/py-pdf/pypdf/releases/tag/6.15.0 - Release Notes
References () https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c - () https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c - Patch, Vendor Advisory
CPE cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
First Time Pypdf Project
Pypdf Project pypdf
Information

Published : 2026-08-07 20:16

Updated : 2026-11-02 16:06

NVD link : CVE-2026-71870

Mitre link : CVE-2026-71870

CVE.ORG link : CVE-2026-71870

JSON object : View

Products Affected

py-pdf

  • pypdf
CWE
CWE-400

Uncontrolled Resource Consumption