CVE-2026-71852
Description
A flaw was found in pypdf. A remote attacker could provide a specially crafted PDF file that, when processed by the Font._collect_cid_character_widths function during text extraction, causes the library to expand unusually large font width ranges. This can lead to excessive memory consumption and long processing times, resulting in a denial of service.
Statement
This Moderate impact denial-of-service vulnerability in the pypdf library can lead to excessive memory consumption and long runtimes when processing specially crafted PDF files. This issue affects Red Hat products that handle untrusted PDF input, potentially causing service disruption due to resource exhaustion. Exploitation requires local access or a user to process a malicious PDF.
Mitigation
To reduce exposure, avoid processing untrusted PDF documents with applications that integrate the pypdf library. Implement robust input validation and sanitization for all PDF files originating from external or unverified sources. Consider deploying applications that process PDF content within a sandboxed environment to contain potential denial of service impacts.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other); Reduce Performance
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
