CVE-2026-27025

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3646](https://github.com/py-pdf/pypdf/pull/3646).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3646](https://github.com/py-pdf/pypdf/pull/3646).

pypdf es una biblioteca PDF escrita puramente en Python, gratuita y de código abierto. Antes de 6.7.1, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados y un gran consumo de memoria. Esto requiere el análisis de la entrada /ToUnicode de una fuente con valores inusualmente grandes, por ejemplo durante la extracción de texto. Esta vulnerabilidad está corregida en 6.7.1.