CVE-2026-48735CWE-770denial-of-service

CVE-2026-48735

Medium · published May 28, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-05-28T20:16Z
Affected products (1)
ProductVersionsFixed in
pypdf_project/pypdf< 6.12.16.12.1
References (3)
https://github.com/py-pdf/pypdf/pull/3796 · [email protected]https://github.com/py-pdf/pypdf/releases/tag/6.12.1 · [email protected]https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c · [email protected]
EPSS history
Timeline
  • 28 MAY 14:49Z
    pypdf: Manipulated XMP metadata streams can exhaust RAM
    cvelistv5