CVE-2026-45802 MEDIUM

CVE-2026-45802: FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

Vendor Setasign
Product FPDI
Weakness CWE-770 · Uncontrolled resource consumption
Published June 11, 2026
Last update June 12, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability. This issue has been patched in version 2.6.7.

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 12, 2026 Record updated