pypdf CVE-2026-71852

pypdf (pkg:pip/pypdf) is a pure-Python library for reading, writing, and manipulating PDF files. The vulnerability resides in pypdf/_font.py within the _collect_cid_character_widths function, which processes the /W (Widths) array of CID (Character Identifier) fonts embedded in PDF documents. CID fonts describe character advance widths using two encoding formats: a range format (start_cid, end_cid, single_width) and a list format (start_cid, [width1, width2, ...]). Prior to the fix, no upper bounds were enforced on range sizes or total entry counts, meaning an attacker could encode a /W array with a range spanning billions of CID values. CWE-834 (Excessive Iteration) precisely describes the root cause: the parser faithfully iterates over the attacker-supplied range, attempting to allocate and populate a massive dictionary of character widths until memory or CPU is exhausted. The fix in PR #3946 introduces two hard limits: MAX_CID_WIDTH_ENTRY_COUNT = 65,536 per individual range and MAX_WIDTH_ENTRY_COUNT = 100,000 cumulative entries, raising LimitReachedError when either threshold is exceeded.