pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

中 5.5CVE-2026-27025 · GHSA-wgvp-vg3v-2xq3 · PYSEC-2026-3024 · 20/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-27025 は pypdf, pypdf (pypdf project) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.19%（全脆弱性の 8.8% より高い）。
対処：6.7.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pypdf PyPI	`< 6.7.1`	`6.7.1`
pypdf pypdf_project	`< 6.7.1`	`6.7.1`

概要

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3646.

NVD の説明

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.