CVE-2026-59938

NameCVE-2026-59938
Descriptionpypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1141771

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypdf (PTS)bookworm3.4.1-1+deb12u1vulnerable
trixie5.4.0-1vulnerable
forky, sid6.9.2-2vulnerable
pypdf2 (PTS)bullseye1.26.0-4+deb11u1vulnerable
bookworm2.12.1-3+deb12u1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypdfsource(unstable)(unfixed)1141771
pypdf2source(unstable)(unfixed)

Notes

[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
[bookworm] - pypdf2 <postponed> (Minor issue)
[bullseye] - pypdf2 <postponed> (Minor issue)
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp
https://github.com/py-pdf/pypdf/pull/3888
Fixed by: https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a (6.14.0)

Search for package or bug name: Reporting problems