HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-102995 — pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a craf...

·Source: NIST NVD

Updated:

Executive Summary

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption

Analysis

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1. CVSS Score: 7.5. Published: 2026-09-30T21:17:06.713.

Indicators of Compromise (1)

CVE (1)
CVE-2026-102995
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Circle, Ripple and Standard Chartered invest in OKX

Crypto exchange OKX has secured strategic investment from Circle, QRT, Ripple and SC Ventures at a $25 billion valuation.

Finextra
CRITICALVulnerabilityNEW

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

CVE-2026-21589
BleepingComputer
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-104070 — The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulner...

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m

CVE-2026-104070
NIST NVD