CVE-2026-48156CWE-834

CVE-2026-48156

Low · published May 28, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-834 · Excessive Iteration
Published
2026-05-28T20:16Z
Affected products (1)
ProductVersionsFixed in
pypdf_project/pypdf< 6.12.06.12.0
References (3)
https://github.com/py-pdf/pypdf/pull/3791 · [email protected]https://github.com/py-pdf/pypdf/releases/tag/6.12.0 · [email protected]https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6 · [email protected]
EPSS history
Timeline
  • 28 MAY 14:50Z
    pypdf: Possible long runtimes for zero-only width values in cross-reference streams
    cvelistv5