CVE-2026-48155CWE-400denial-of-service

CVE-2026-48155

Medium · published May 28, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-05-28T20:16Z
Affected products (1)
ProductVersionsFixed in
pypdf_project/pypdf< 6.12.06.12.0
References (3)
https://github.com/py-pdf/pypdf/pull/3790 · [email protected]https://github.com/py-pdf/pypdf/releases/tag/6.12.0 · [email protected]https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8 · [email protected]
EPSS history
Timeline
  • 28 MAY 14:51Z
    pypdf: Possible large memory usage for large offsets for layout mode text
    cvelistv5