Medium severityNVD Advisory· Published Aug 7, 2026

CVE-2026-71870

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pypdfPyPI	< 6.15.0	6.15.0

Affected products

Py PDF/Pypdfllm-fuzzy
Range: <6.15.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fp3f-mc75-235cghsaADVISORY
github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aanvdWEB
github.com/py-pdf/pypdf/pull/3944nvdWEB
github.com/py-pdf/pypdf/releases/tag/6.15.0nvdWEB
github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235cnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000