PT-2026-44392 · Pypi · Pypdf

Sondt99 · CVE-2026-48155 · Published 2026-05-28 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.12.0

Description A flaw in the pure-python PDF library allows an attacker to craft a PDF file that causes excessive memory consumption. This occurs when extracting text in layout mode using large character offsets.

Recommendations Update to version 6.12.0.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-48155

GHSA-CJ93-CHG6-VGV8

OPENSUSE-SU-2026:10974-1

PYSEC-2026-3016

Affected Products

Pypdf

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48155.json · Exploit
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8 · Vendor Advisory
• https://github.com/py-pdf/pypdf/pull/3790 · Patch
• https://cve.org/CVERecord?id=CVE-2026-48155 · Security Note
• https://ubuntu.com/security/CVE-2026-48155 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48155 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-48155 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3016 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48155 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10974-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj93-chg6-vgv8 · Vendor Advisory
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0 · Note
• https://github.com/py-pdf/pypdf · Note