{"id":"CVE-2026-59938","aliases":["CLSA-2026-1786946462","DEBIAN-CVE-2026-59938","EUVD-2026-42343","GHSA-5qjq-93h5-hrgp","GHSA-x284-j5p8-9c5p","PYSEC-2026-3611","UBUNTU-CVE-2026-59938"],"status":"published","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00515,"percentile":0.44355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-07-08T17:24:29Z","modified":"2026-11-04T02:47:45Z","fixes":[{"ecosystem":"PyPI","package":"pypdf","fixed_in":["6.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pypdf","fixed_in":["6.19.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.9.0.post12+tuxcare"}]}],"versions":["5.9.0","5.9.0.post1+tuxcare","5.9.0.post10+tuxcare","5.9.0.post11+tuxcare","5.9.0.post2+tuxcare","5.9.0.post3+tuxcare","5.9.0.post4+tuxcare","5.9.0.post5+tuxcare","5.9.0.post6+tuxcare","5.9.0.post7+tuxcare","5.9.0.post8+tuxcare","5.9.0.post9+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-1","3.4.1-1","3.4.1-1+deb12u1","4.0.0-1","4.0.0-1~exp1","4.0.1-1","4.0.2-1","4.1.0-1","4.2.0-1","4.3.1-1","5.4.0-1","6.19.0-1","6.21.0-1","6.21.1-1","6.21.4-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.19.0-1","6.21.0-1","6.21.1-1","6.21.4-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.0-1"}]}],"versions":["5.4.0-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-3","2.12.1-3+deb12u1","2.12.1-4"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.16.0","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","5.0.0","5.0.1","5.1.0","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.6.1","5.7.0","5.8.0","5.9.0","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.10.0","6.10.1","6.10.2","6.11.0","6.12.0","6.12.1","6.12.2","6.13.0","6.13.1","6.13.2","6.13.3","6.2.0","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.6.0","6.6.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","6.7.5","6.8.0","6.9.0","6.9.1","6.9.2"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.16.0","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","5.0.0","5.0.1","5.1.0","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.6.1","5.7.0","5.8.0","5.9.0","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.10.0","6.10.1","6.10.2","6.11.0","6.12.0","6.12.1","6.12.2","6.13.0","6.13.1","6.13.2","6.13.3","6.2.0","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.6.0","6.6.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","6.7.5","6.8.0","6.9.0","6.9.1","6.9.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23+git20141008-1","1.25.1-1","1.25.1-1ubuntu0.1~esm1","1.25.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-2","1.26.0-2ubuntu0.1~esm1","1.26.0-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1","1.26.0-3ubuntu1.20.04.1","1.26.0-3ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-4","1.26.0-4ubuntu0.22.04.1","1.26.0-4ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1-1","3.17.4-1","4.0.0-1","4.0.1-1","4.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-3","2.12.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-1","5.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.9.2-1"]}],"products":[{"vendor":"py-pdf","product":"pypdf"}],"references":[{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/py-pdf/pypdf/pull/3888","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.0","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59938","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5qjq-93h5-hrgp","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59938.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59938","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf","tags":["package"]},{"url":"https://pypi.org/project/pypdf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-59938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59938","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59938","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T17:24:29.959Z","modified":"2026-07-09T13:58:17.678Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-42343","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T17:24:29Z","modified":"2026-07-09T13:58:17Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"ghsa":[{"id":"GHSA-5qjq-93h5-hrgp","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.\n\n### Patches\n\nThis has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3888](https://github.com/py-pdf/pypdf/pull/3888).","status":"published","published":"2026-07-23T15:06:58Z","modified":"2026-07-23T15:06:59Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:40:52.46233Z"}],"nvd":[{"id":"CVE-2026-59938","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T18:16:35.097Z","modified":"2026-11-02T16:06:04.477Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T20:51:39.407314Z"}],"osv":[{"id":"CVE-2026-59938","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T17:24:29.959Z","modified":"2026-11-04T02:47:45.39795131Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-04T02:53:00.786919Z"},{"id":"DEBIAN-CVE-2026-59938","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T18:16:35.097Z","modified":"2026-11-03T10:00:27.281550612Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-5qjq-93h5-hrgp","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.\n\n### Patches\n\nThis has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3888](https://github.com/py-pdf/pypdf/pull/3888).","status":"published","published":"2026-07-23T15:06:58Z","modified":"2026-09-10T03:51:10.49541738Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"PYSEC-2026-3611","title":"pypdf: Possible large memory usage for wrong image dimensions","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.\n\n### Patches\n\nThis has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3888](https://github.com/py-pdf/pypdf/pull/3888).","status":"published","published":"2026-08-04T11:34:41.605981Z","modified":"2026-08-04T14:30:29.975242941Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2026-59938","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.","status":"published","published":"2026-07-08T18:16:00Z","modified":"2026-10-17T12:56:00.571313028Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1786946462","title":"TuxCare security update for pypdf (6 CVEs)","description":"TuxCare rebuilt pypdf to address 6 CVEs. Fixed in 5.9.0.post12+tuxcare.","status":"published","published":"2026-08-17T06:01:02Z","modified":"2026-10-15T09:48:05.559583552Z","updated_at":"2026-11-02T15:43:47.20725Z"}]}}