Listen to this Post
The vulnerability stems from how pypdf handles the `/ToUnicode` entry in a PDF’s font dictionary. During text extraction, the library parses this stream to map character codes to Unicode values. An attacker can craft a PDF where the `/ToUnicode` stream contains excessively large data structures or deeply nested tables . When pypdf attempts to process this malicious stream, it allocates massive amounts of memory and enters prolonged computational loops to parse the inflated data. This leads to extreme memory consumption and near-infinite processing times, effectively causing a Denial of Service (DoS) by exhausting system resources. The issue is triggered during standard PDF parsing operations like text extraction .
Platform: pypdf
Version: <6.7.1
Vulnerability: Resource exhaustion
Severity: Moderate
date: 17 Feb 2026
Prediction: 18 Feb 2026
What Undercode Say:
Analytics
Check installed pypdf version pip show pypdf | grep Version List all installed packages to verify dependencies pip list | grep pypdf Check Python environment for the vulnerable package python3 -c "import pypdf; print(pypdf.<strong>version</strong>)"
Exploit
Craft a malicious PDF with oversized /ToUnicode stream
from pypdf import PdfWriter, PdfReader
Example of how a malicious stream might be structured
malicious_content = b"""
/ToUnicode <<
/Length 9999999
<blockquote>
<blockquote>
stream
...extremely large data...
endstream
"""
This would cause excessive memory allocation when read
reader = PdfReader("malicious.pdf")
reader.pages[bash].extract_text()
Protection
Upgrade to patched version immediately pip install --upgrade pypdf==6.7.1 Verify the upgrade pip show pypdf | grep Version If unable to upgrade, apply the patch from PR 3646 manually Download and apply the patch file wget https://github.com/py-pdf/pypdf/pull/3646.patch patch -p1 < 3646.patch
Impact
Monitor resource usage during PDF processing Check for excessive memory consumption top -p $(pgrep -f "python.pypdf") Monitor system memory pressure watch -n 1 free -h Example of resource limits to prevent DoS Set ulimit for processes handling untrusted PDFs ulimit -v 1048576 Limit virtual memory to 1GB
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
