Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pypdf Project | Pypdf | < 6.14.0 |
Related Weaknesses (CWE)
References
- https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7aPatch
- https://github.com/py-pdf/pypdf/pull/3888Issue TrackingPatch
- https://github.com/py-pdf/pypdf/releases/tag/6.14.0ProductRelease Notes
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgpPatchVendor Advisory
FAQ
What is CVE-2026-59938?
CVE-2026-59938 is a vulnerability with a CVSS score of 5.3 (MEDIUM). pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large...
How severe is CVE-2026-59938?
CVE-2026-59938 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59938?
Check the references section above for vendor advisories and patch information. Affected products include: Pypdf Project Pypdf.