CVE-2026-59938: CVE-2026-59938: Uncontrolled Memory Allocation (DoS) in pypdf Image Parsing

#security #cve #cybersecurity

CVE-2026-59938: Uncontrolled Memory Allocation (DoS) in pypdf Image Parsing

Vulnerability ID: CVE-2026-59938
CVSS Score: 5.3
Published: 2026-07-23

An uncontrolled memory allocation vulnerability (CWE-789) exists in pypdf prior to version 6.14.0. The library blindly trusted user-controlled image dimensions (/Width and /Height) from PDF metadata, allowing attackers to trigger physical memory exhaustion and an Out-of-Memory crash via tiny, malformed files.

TL;DR

Uncontrolled memory allocation in pypdf < 6.14.0 allows remote attackers to cause a Denial of Service (OOM crash) by submitting a small PDF with artificially large image dimensions (/Width and /Height) in XObject metadata.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-789
Attack Vector: Network
CVSS Score: 5.3 (CVSS v3.1)
EPSS Score: 0.00303 (Percentile: 22.45%)
Impact: Denial of Service (OOM Application Crash)
Exploit Status: Proof-of-Concept (PoC) available
KEV Status: Not Listed

Affected Systems

pypdf Python Library
pypdf: < 6.14.0 (Fixed in: 6.14.0)

Exploit Details

GitHub Security Advisory: Details regarding the uncontrolled memory usage for wrong image dimensions.

Mitigation Strategies

Upgrade pypdf library to version 6.14.0 or above.
Manually configure FLATE_MAX_BUFFER_SIZE inside application code.
Apply OS-level or container-level memory resource constraints.

Remediation Steps:

Verify the version of pypdf currently installed by running: pip show pypdf
Update the library to the fixed release: pip install --upgrade pypdf>=6.14.0
Configure pypdf.filters.FLATE_MAX_BUFFER_SIZE in the application initialization scripts if a smaller boundary is required (e.g., 20MB: pypdf.filters.FLATE_MAX_BUFFER_SIZE = 20000000).

References

Read the full report for CVE-2026-59938 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community