{"id":"CVE-2026-27025","title":"pypdf: pypdf: Denial of Service via crafted PDF with large font values (CVE-2026-27025)","summary":"A flaw was found in pypdf. An attacker can craft a malicious PDF file containing unusually large values in the /ToUnicode entry of a font. When this crafted PDF is processed, for example during text extraction, it can lead to excessive res…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-1050","vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["openshift_lightspeed","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"patched":["pypdf 6.7.1"],"published":"2026-02-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:34:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27025.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27025.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27025"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441494"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27025"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27025"},{"url":"https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2"},{"url":"https://github.com/py-pdf/pypdf/pull/3646"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.1"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00191,"epssPercentile":0.08644,"aliases":["GHSA-wgvp-vg3v-2xq3","PYSEC-2026-3024"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:04.541Z","slug":"CVE-2026-27025","body":"## Overview\n\nA flaw was found in pypdf. An attacker can craft a malicious PDF file containing unusually large values in the /ToUnicode entry of a font. When this crafted PDF is processed, for example during text extraction, it can lead to excessive resource consumption, resulting in a Denial of Service (DoS) due to long runtimes and large memory usage.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27025.json)\n\n**pypdf: pypdf: Denial of Service via crafted PDF with large font values** — rated Moderate by Red Hat. Released 2026-02-20, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-27025)\n\nAffected packages:\n\n- `pypdf < 6.7.1`\n\nPatched in:\n\n- `pypdf 6.7.1`\n\nSource: https://osv.dev/vulnerability/GHSA-wgvp-vg3v-2xq3","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222189,"id":"CVE-2026-27025","ts":1792065058546,"field":"cvss","old":null,"new":"6.5"}]}