{"id":"CVE-2026-48155","title":"pypdf is a free and open-source pure-python PDF library","summary":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offset…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"pypdf_project","product":"pypdf","affected":["pypdf < 6.12.0"],"patched":["pypdf 6.12.0"],"published":"2026-05-28","updated":"2026-10-14","sourceUpdated":"2026-10-14T20:10:00.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48155","references":[{"url":"https://github.com/py-pdf/pypdf/pull/3790","label":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.0","label":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48155"},{"url":"https://github.com/py-pdf/pypdf"},{"url":"https://github.com/advisories/GHSA-cj93-chg6-vgv8"}],"tags":["nvd","osv","pip","ghsa"],"epss":0.00127,"epssPercentile":0.02369,"aliases":["GHSA-cj93-chg6-vgv8","PYSEC-2026-3016"],"ecosystem":"pip","ingestedAt":"2026-07-07T15:41:59.225Z","slug":"CVE-2026-48155","body":"## Overview\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.\n\n## Affected\n\n- `pypdf < 6.12.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pypdf 6.12.0`\n\n## Package advisory (CVE-2026-48155)\n\nAffected packages:\n\n- `pypdf < 6.12.0`\n\nPatched in:\n\n- `pypdf 6.12.0`\n\nSource: https://osv.dev/vulnerability/GHSA-cj93-chg6-vgv8","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":220478,"id":"CVE-2026-48155","ts":1792011299202,"field":"cvss","old":null,"new":"5.5"}]}