pypdf CVE-2026-102996

Requires that the target application invoke pypdf (version prior to 6.18.1) to parse an attacker-supplied PDF - specifically operations that read font widths such as text extraction - on a document containing a simple TrueType or Type1 font whose /Widths array holds more than the 256 entries meaningful for a one-byte-encoded simple font. No authentication, user interaction beyond supplying the document, or non-default configuration is needed. The practical limiting factor is that an application must actually feed untrusted PDFs into pypdf's extraction path; deployments that only process trusted internal documents, or that do not perform text/font extraction, are not exposed. Impact is confined to memory exhaustion of the processing worker - no code execution or data disclosure.

This is a genuine but bounded issue: a memory-exhaustion denial of service (CWE-400) in the pypdf pure-python PDF library, with no confidentiality or integrity impact. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H = 8.7 HIGH) captures a network-reachable, low-complexity, unauthenticated availability hit, which is a reasonable characterization for a library that routinely processes untrusted, user-supplied PDFs in server-side upload/extraction pipelines. However, the 8.7 'HIGH' rating overstates operational danger: the only impact is transient memory pressure during text extraction on a single crafted document, not code execution, data exposure, or persistent service loss. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - though the fixing PR (#4072) ships a reproducer test, so a trigger is trivially derivable. Signals are internally consistent (network-facing library DoS with a low-effort trigger), so no conflict to flag; the main caveat is that AV:N/UI:N assumes an application that automatically feeds attacker-controlled PDFs to pypdf, which is common but not universal. Net: a real defect worth patching promptly on internet-facing PDF-processing services, but a DoS-capped, non-critical priority rather than an emergency.

An attacker uploads a crafted PDF to a web service that uses pypdf to extract text (e.g. a document indexer, search ingestion pipeline, or resume/invoice parser). The PDF declares a simple TrueType or Type1 font whose /Widths array contains far more than 256 entries; when Font._collect_tt_t1_character_widths iterates the oversized array, memory consumption balloons and the worker process is starved or OOM-killed. No public exploit is published, but the fix PR includes a test that reproduces the limit trigger, making a proof-of-concept easy to construct.