CVE-2026-48735

MEDIUM EPSS 3.0%
Published May 28, 20261mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
3.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-770

Affected Products 1

VendorProductVersionRange
pypdf_projectpypdf* <6.12.1

References 3

  • github.com https://github.com/py-pdf/pypdf/pull/3796
    Issue TrackingPatch
  • github.com https://github.com/py-pdf/pypdf/releases/tag/6.12.1
    Release Notes
  • github.com https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
    PatchVendor Advisory

Remediation

  • github.com https://github.com/py-pdf/pypdf/pull/3796
    Issue TrackingPatch
  • github.com https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
    PatchVendor Advisory