PT-2026-44399 · Pypi · Pypdf

Manop55555 · Published 2026-05-28 · Updated 2026-06-16 · CVE-2026-48735

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.12.1

Description An attacker can craft a PDF file that causes excessive memory consumption during the parsing of large XMP metadata, which may contain numerous unnecessary elements.

Recommendations Update to version 6.12.1.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-48735

GHSA-WJQC-6W8F-H24C

OPENSUSE-SU-2026:10974-1

Affected Products

Pypdf

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48735.json · Exploit
• https://github.com/py-pdf/pypdf/pull/3796 · Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48735 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48735 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10974-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48735 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48735 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48735 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48735 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjqc-6w8f-h24c · Vendor Advisory
• https://github.com/py-pdf/pypdf/releases/tag/6.12.1 · Note
• https://github.com/py-pdf/pypdf · Note
• https://t.me/cveNotify/165261 · Telegram Post