CVE-2026-102996

Summary

A memory exhaustion vulnerability in pypdf allows attackers to craft malicious PDFs with oversized font width arrays that cause excessive memory consumption during text extraction operations. This can lead to denial of service through resource exhaustion.

Exploitability

Exploitation is relatively straightforward as it requires only crafting a malicious PDF file with oversized font data, with no special preconditions needed for the target system.

Blast radius

The impact could be significant across any application or service that processes PDF files using pypdf, particularly those handling untrusted PDF uploads or automated text extraction workflows.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.18.1 or later to remediate this memory exhaustion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.