CVE-2026-48155 MEDIUM

CVE-2026-48155: pypdf: Possible large memory usage for large offsets for layout mode text

Vendor Py-Pdf
Product pypdf
Weakness CWE-400
Published May 28, 2026
Last update May 28, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

Key dates

02Disclosure timeline

May 28, 2026 CVE published
May 28, 2026 Record updated