GitHub Advisoryadvisory · PyPI

GHSA-5qjq-93h5-hrgp pypdf: Possible large memory usage for wrong image dimensions

MEDIUM Published 2026-07-23 Modified 2026-07-23 Official page ↗
Aliases
CVE-2026-59938
Ecosystem
PyPI
Packages
pypdf
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-789
Reviewed
2026-07-23

Affected packages

• PyPI pypdf: < 6.14.0 → fixed in 6.14.0

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #3888.

Related

Alias · CVE (1)

  • CVE-2026-59938 pypdf is a free and open-source pure-python PDF library. vulnerability

Weakness · CWE (1)

  • CWE-789 Memory Allocation with Excessive Size Value weakness

References