CVE-2026-102993

Summary

A crafted PDF file can cause pypdf to generate excessively large numeral strings when retrieving page labels, leading to high memory consumption and potential application unavailability. This vulnerability affects applications using pypdf to process PDFs.

Exploitability

Exploitation is relatively straightforward as it requires only a specially crafted PDF file that triggers large page label values, with no additional preconditions needed.

Blast radius

The impact could be significant in environments where PDF processing is automated or frequently used, potentially causing denial of service across multiple applications relying on pypdf.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.17.0 or later to remediate this memory exhaustion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.