CVE-2026-102993
HIGHCVSS 7.5Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
Timeline
Published:September 30th, 2026 8:17 PM
Last modified:November 2nd, 2026 4:06 PM
CVSS Scoring
CVSS v3: 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Software
From NVD CPE configuration data
Vendors
py-pdf
Products
pypdf
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute