{"id":"CVE-2026-102995","title":"pypdf is a free and open-source pure-python PDF library","summary":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and re…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-770"],"vendor":"pypdf_project","product":"pypdf","affected":["pypdf < 6.18.1"],"patched":["pypdf 6.18.1"],"published":"2026-09-30","updated":"2026-10-05","sourceUpdated":"2026-10-05T15:23:15.717","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102995","references":[{"url":"https://github.com/py-pdf/pypdf/commit/319d0b823ce2c311a2435e9fd93c13994d32bb51","label":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4071","label":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","label":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3h-c4fm-7vvf","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102995.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102995"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544273"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102995"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102995"},{"url":"https://github.com/advisories/GHSA-fp3h-c4fm-7vvf"},{"url":"https://github.com/py-pdf/pypdf"},{"url":"https://pypi.org/project/pypdf"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","pip","osv","score-dispute"],"epss":0.0034,"epssPercentile":0.27373,"aliases":["GHSA-fp3h-c4fm-7vvf","PYSEC-2026-4154"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-01T18:50:23.022437Z"},"scores":{"nvd":7.5,"cna":8.7,"vendor":6.5},"ingestedAt":"2026-09-30T21:25:07.838Z","slug":"CVE-2026-102995","body":"## Overview\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.\n\n## Affected\n\n- `pypdf < 6.18.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pypdf 6.18.1`\n\n## Package advisory (CVE-2026-102995)\n\nAffected packages:\n\n- `pypdf < 6.18.1`\n\nPatched in:\n\n- `pypdf 6.18.1`\n\nSource: https://github.com/advisories/GHSA-fp3h-c4fm-7vvf\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Ansible Automation Orchestrator 2026, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Quay 3, Ansible Automation Orchestrator 2026, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102995.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":215897,"id":"CVE-2026-102995","ts":1791217625486,"field":"cvss","old":"8.7","new":"7.5"}]}