6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27025

CVE-2026-27025: pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3646.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27025

CVE-2026-27025:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.1	6.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to cause a denial of service (DoS) via excessive memory and CPU consumption by crafting a malicious PDF file. The root cause is the lack of input validation in the parsing of the /ToUnicode CMap, which is used for mapping character codes to Unicode values during text extraction.

The analysis of the patch commit 77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2 reveals that the core of the vulnerability lies in two functions within the pypdf._cmap module: parse_bfrange and parse_bfchar.

pypdf._cmap.parse_bfrange: This function handles bfrange operators. A malicious PDF can define a range with a very large difference between its start and end values. The original code would loop through this entire range, creating dictionary entries and consuming significant CPU and memory. The patch mitigates this by adding a check (_check_mapping_size) to ensure the size of the range does not exceed a predefined limit before entering the loop.
pypdf._cmap.parse_bfchar: This function handles bfchar operators, which define individual character mappings. A malicious PDF can include a vast number of these mappings. The original code would process all of them, leading to a large dictionary being created in memory. The patch adds a similar size check at the beginning of the function to limit the number of mappings processed.

These functions are the direct points of exploitation where the malicious data from the PDF is processed without proper limits, leading to the DoS condition. Any operation that involves text extraction from a PDF, such as calling the PageObject.extract_text() method, could trigger these vulnerable functions.

Vulnerable functions

pypdf._cmap.parse_bfrange

pypdf/_cmap.py

This function parses `bfrange` operators within a PDF's `/ToUnicode` CMap. A crafted PDF can specify a very large character range, causing the function to enter a long loop that allocates a large amount of memory for the character map. This leads to a denial of service through high CPU and memory usage. The vulnerability is the lack of input validation on the range size.

pypdf._cmap.parse_bfchar

pypdf/_cmap.py

This function parses `bfchar` operators within a PDF's `/ToUnicode` CMap. A crafted PDF can provide a huge number of character mappings. This function would then attempt to process all of them, leading to the creation of a very large dictionary in memory and causing excessive memory consumption, resulting in a denial of service. The vulnerability is the lack of a limit on the number of characters to process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.