{"id":"CVE-2026-59938","title":"pypdf: pypdf: Possible large memory usage for wrong image dimensions (CVE-2026-59938)","summary":"A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file with image size values that are significantly larger than the actual embedded image data…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":["CWE-770","CWE-789"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["exploit_intelligence","openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","quay 3"],"patched":["pypdf 6.14.0"],"published":"2026-07-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:20:47+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59938.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59938.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59938"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498171"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59938"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59938"},{"url":"https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a"},{"url":"https://github.com/py-pdf/pypdf/pull/3888"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.0"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp"},{"url":"https://github.com/py-pdf/pypdf"},{"url":"https://github.com/advisories/GHSA-5qjq-93h5-hrgp"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00515,"epssPercentile":0.43694,"aliases":["GHSA-5qjq-93h5-hrgp","PYSEC-2026-3611"],"ecosystem":"pip","ingestedAt":"2026-07-23T15:18:37.973Z","slug":"CVE-2026-59938","body":"## Overview\n\nA flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file with image size values that are significantly larger than the actual embedded image data, causing pypdf to allocate large amounts of memory when processing the file.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Quay 3 · no fix planned: Exploit Intelligence, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59938.json)\n\n**pypdf: pypdf: Possible large memory usage for wrong image dimensions** — rated Moderate by Red Hat. Released 2026-07-08, updated 2026-10-15.\n\nAffected:\n\n- Exploit Intelligence\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n\nNo fix planned:\n\n- Exploit Intelligence\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-59938)\n\nAffected packages:\n\n- `pypdf < 6.14.0`\n\nPatched in:\n\n- `pypdf 6.14.0`\n\nSource: https://osv.dev/vulnerability/GHSA-5qjq-93h5-hrgp","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222211,"id":"CVE-2026-59938","ts":1792065084798,"field":"cvss","old":null,"new":"5.3"}]}