CVE-2026-40260: pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.
Patches This has been fixed in pypdf==6.10.0.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3724.
Other sources
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.10.0 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.19.0-1 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.1-1Fixed in 6.21.4-1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.10.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #3724.