CVE-2026-48156

LOW SEVERITY

CVSS Score & Metrics

Base Score

3.3 / 10

Vector String

                                        CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L                                    

Vulnerability Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.

Vulnerability Details

Published Date

May 28, 2026

Last Modified

June 12, 2026

CWE ID

CWE-834

Source

NVD

Vendor

py-pdf

Product

pypdf

External References

https://github.com/py-pdf/pypdf/pull/3791
https://github.com/py-pdf/pypdf/releases/tag/6.12.0
https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6

CVE-2026-48156

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment