CVE-2026-71852: 
Python vulnerability analysis and mitigation

CVE-2026-71852 is a resource exhaustion vulnerability in pypdf, a free and open-source pure-Python PDF library, that allows a crafted PDF to cause long runtimes and excessive memory consumption during text extraction. The vulnerability exists in the Font._collect_cid_character_widths function in pypdf/_font.py, which fails to limit the size of CID font /W width ranges or the total number of width entries processed. All pypdf versions prior to 6.15.0 are affected. It was published on August 6–7, 2026, and carries a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-834 (Excessive Iteration) and CWE-1050 (Excessive Platform Resource Consumption within a Loop). The _collect_cid_character_widths static method in pypdf/_font.py iterates over the /W array of a CID font's DescendantFont dictionary without enforcing any upper bound on the range size or total entry count. An attacker can craft a PDF with a CID font containing either an unusually large range (e.g., 1 100000 42, specifying widths for 100,000 characters) or an excessive number of individual width entries, triggering unbounded iteration and memory allocation when the PDF is parsed — for example, during text extraction. The fix introduced in PR #3946 adds hard limits: MAX_CID_WIDTH_ENTRY_COUNT = 65,536 per range and MAX_WIDTH_ENTRY_COUNT = 100,000 total entries, raising a LimitReachedError when exceeded (Github Advisory, pypdf PR #3946, pypdf commit).

Successful exploitation degrades availability of the affected system by causing the Python process running pypdf to consume excessive CPU time and memory, potentially hanging or crashing applications that process untrusted PDFs. There is no impact on confidentiality or integrity — the vulnerability is purely a denial-of-service condition. Systems most at risk include document processing pipelines, web services, or automated workflows that accept and parse user-supplied PDF files using pypdf (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.00127 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires passive user interaction — a user or automated process must open and parse the malicious PDF — and no privileges are required on the part of the attacker (Github Advisory, Feedly).

1. Craft a malicious PDF: Create a PDF containing a CID font with a /W (widths) array that specifies an extremely large character range or an excessive number of width entries. For example, using format 2 (start_idx stop_idx width): embed /W [1 100000 42] in a DescendantFont dictionary to define widths for 100,000 characters.
2. Deliver the PDF: Submit the crafted PDF to a target system that uses pypdf for text extraction or other parsing operations — such as a web upload endpoint, email attachment processor, or document conversion service.
3. Trigger parsing: Cause the application to invoke pypdf's text extraction or font parsing functionality on the malicious PDF (e.g., calling PdfReader and accessing page text), which invokes Font._collect_cid_character_widths.
4. Achieve denial of service: The unbounded iteration over the oversized /W array causes the Python process to consume excessive CPU and memory, resulting in degraded performance, application hang, or out-of-memory crash (Github Advisory, pypdf PR #3946).

• Process: Python processes consuming abnormally high CPU or memory when processing PDF files; processes that hang indefinitely during PDF text extraction operations.
• Logs: Application-level errors or timeouts associated with PDF parsing; stack traces referencing pypdf/_font.py and _collect_cid_character_widths in error logs.
• File System: Presence of suspicious PDF files with unusually large CID font /W arrays submitted via upload endpoints or found in processing queues.

Upgrade pypdf to version 6.15.0 or later, which introduces hard limits on CID font width range sizes (MAX_CID_WIDTH_ENTRY_COUNT = 65,536) and total width entry counts (MAX_WIDTH_ENTRY_COUNT = 100,000), raising a LimitReachedError when these are exceeded. For environments that cannot upgrade immediately, the changes from PR #3946 can be applied manually as a workaround. Additionally, consider implementing file size limits and pre-validation on untrusted PDF inputs before passing them to pypdf (Github Advisory, pypdf Release 6.15.0, pypdf PR #3946).