pypdf: Possible large memory usage for wrong image dimensions

🗓️ 23 Jul 2026 15:06:58Reported by GitHub Advisory DatabaseType

Attackers can craft a PDF with large image dimensions to cause memory usage; fixed in pypdf 6.14.0.

Reporter	Title	Published	Views	Family All 43
ATTACKERKB	CVE-2026-59938	8 Jul 202617:24	–	attackerkb
Chainguard	CVE-2026-59938 vulnerabilities	29 Jul 202620:23	–	cgr
Circl	CVE-2026-59938	8 Jul 202619:45	–	circl
CVE	CVE-2026-59938	8 Jul 202617:24	–	cve
Cvelist	CVE-2026-59938 pypdf: Possible large memory usage for wrong image dimensions	8 Jul 202617:24	–	cvelist
Debian CVE	CVE-2026-59938	8 Jul 202617:24	–	debiancve
EUVD	EUVD-2026-42343	23 Jul 202615:06	–	euvd
NVD	CVE-2026-59938	8 Jul 202618:16	–	nvd
OSV	CGA-PVH5-Q2H5-QV7H	29 Jul 202616:11	–	osv
OSV	CLEANSTART-2026-EH47852 Security fixes for CVE-2026-34180, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, ghsa-537c-gmf6-5ccf, ghsa-jm82-fx9c-mx94 applied in versions: 1.85.1-r0, 1.89.5-r0, 1.90.2-r0	21 Jul 202607:54	–	osv

Vulners

Node

Source	Link
github	www.github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59938
github	www.github.com/py-pdf/pypdf/pull/3888
github	www.github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a
github	www.github.com/py-pdf/pypdf/releases/tag/6.14.0
github	www.github.com/advisories/GHSA-5qjq-93h5-hrgp

23 Jul 2026 15:06Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3

CVSS 46.9

EPSS0.00303

SSVC