CVE-2026-102993 · GHSA-qv6h-rv94-w285
pypdf: Possible large memory usage when retrieving Roman page labels
- Risk score
- 60/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentiall…
- Affected
- pypdf (pip) < 6.17.0
- Fix
- Upgrade pypdf to 6.17.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.17.0 | 6.17.0 |
References
- https://github.com/advisories/GHSA-qv6h-rv94-w285
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285
- https://nvd.nist.gov/vuln/detail/CVE-2026-102993
- https://github.com/py-pdf/pypdf/pull/4047
- https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163
- https://github.com/py-pdf/pypdf/releases/tag/6.17.0
- https://github.com/advisories/GHSA-qv6h-rv94-w285
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
Last activity 30 Sep 2026. Patch Forecast updates every hour.