CVE-2026-48735
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
May 28, 2026
CISA due date
—
The record
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-pypdf | 0 | 6.13.0-1.1 |
Related vulnerabilities
- CVE-2026-54651 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-48155 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-41312 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-41168 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-40260 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-33699 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-33123 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf
- CVE-2026-31826 pypdf is a free and open-source pure-python PDF library. Also affects python-pypdf