CVE-2026-71870: 
Python vulnerability analysis and mitigation

CVE-2026-71870 is a denial-of-service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by uncontrolled memory consumption during font CMap parsing. A crafted PDF with unusually large source-code or destination-string tokens in a font /ToUnicode CMap entry can trigger excessive memory allocation when the parse_bfrange function in pypdf/_cmap.py processes the file, for example during text extraction. All pypdf versions prior to 6.15.0 are affected. The vulnerability was published on August 7, 2026, with a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in pypdf/_cmap.py. The parse_bfrange function parsed /ToUnicode CMap entries without enforcing any upper bound on the length of source-code or destination-string tokens, allowing a maliciously crafted PDF to supply arbitrarily large hex-encoded tokens that cause the library to allocate proportionally large amounts of memory. Exploitation requires local file access and passive user interaction — a user or automated process must attempt to extract text from the malicious PDF. The fix introduced explicit token-length limits: MAX_CMAP_CODE_BYTES = 8 (16 hex chars) and MAX_CMAP_STRING_BYTES = 512 (1024 hex chars), enforced via a new _check_token_length helper that raises LimitReachedError when exceeded (Github Advisory, Patch PR, Commit).

Successful exploitation causes excessive memory consumption on the host running pypdf, potentially exhausting available system memory and degrading or crashing the affected process or system (availability impact). There is no confidentiality or integrity impact — the vulnerability cannot be used to read sensitive data or modify system state. Applications that automatically process untrusted PDF files (e.g., document pipelines, web upload handlers) are at greatest risk, as a single crafted PDF submission could trigger a denial-of-service condition (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-71870. The EPSS score is approximately 0.129%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to supply a crafted PDF to a system that processes it with a vulnerable version of pypdf, which limits the attack surface to scenarios where untrusted PDFs are parsed (Github Advisory, Feedly).

1. Craft a malicious PDF: Create a PDF file containing a font resource with a /ToUnicode CMap stream. Within a beginbfrange/endbfrange block, insert entries with abnormally large hex-encoded source-code or destination-string tokens (e.g., a destination string of thousands of hex characters, far exceeding the normal 1–4 byte range).
2. Deliver the PDF: Provide the crafted PDF to a target system or user that processes PDFs with a vulnerable version of pypdf (< 6.15.0), such as uploading it to a document processing service or sending it to a user who will open it with a pypdf-based tool.
3. Trigger text extraction: Cause the application to perform text extraction on the PDF (e.g., calling PdfReader.pages[n].extract_text()), which invokes pypdf/_cmap.py's parse_bfrange function to parse the /ToUnicode CMap.
4. Memory exhaustion: The unbounded token parsing causes the process to allocate large amounts of memory proportional to the token size, potentially exhausting system RAM and causing the process or host to become unresponsive or crash (Github Advisory, Patch PR).

• Process: Sudden spike in memory usage by a Python process running pypdf during PDF text extraction; process may be killed by the OS OOM killer.
• Logs: Application-level errors or crashes during PDF processing, particularly stack traces referencing pypdf/_cmap.py and the parse_bfrange function; system logs showing out-of-memory events (oom-kill entries on Linux).
• File System: Presence of unusually large or malformed PDF files submitted to document processing directories, especially those with oversized /ToUnicode CMap streams in embedded font resources.

Upgrade pypdf to version 6.15.0 or later, which enforces token-length limits in the parse_bfrange function and resolves this vulnerability (pypdf Release). For environments that cannot upgrade immediately, the maintainer recommends manually applying the changes from PR #3944, which introduces the _check_token_length helper and the MAX_CMAP_CODE_BYTES / MAX_CMAP_STRING_BYTES limits (Patch PR). Additionally, consider sandboxing PDF processing workloads and enforcing memory limits on processes that handle untrusted PDF files to reduce the blast radius of exploitation.