What’s Vulnerable › Vulnerabilities

CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-02
• Weakness: CWE-400

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

Affected products

• py-pdf pypdf: before 6.17.0 — fixed in 6.17.0

How to fix

Upgrade to a fixed version: py-pdf pypdf 6.17.0. Check the vendor advisory for mitigations.

References

• https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163
• https://github.com/py-pdf/pypdf/pull/4047
• https://github.com/py-pdf/pypdf/releases/tag/6.17.0
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285

Get alerted when CVE-2026-102993 or the next vulnerability affects your stack