CVE-2026-45802CWE-400CWE-770

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

Medium · published June 11, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability. This issue has been patched in version 2.6.7.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00451 · 38.2th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-06-11T18:59Z
EPSS history
Timeline
  • 11 JUN 18:59Z
    FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
    cvelistv5