CVE-2026-48155: pypdf: Possible large memory usage for large offsets for layout mode text
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.
Patches
This has been fixed in pypdf==6.12.0.
Workarounds
If developers are unable to immediately upgrade, they should consider applying the changes from PR #3790.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48155?
The severity of CVE-2026-48155 is medium with a CVSS score of 4.8.
How do I fix CVE-2026-48155?
To fix CVE-2026-48155, upgrade to pypdf version 6.12.0 or later.
What impact does CVE-2026-48155 have on systems using pypdf?
CVE-2026-48155 can lead to large memory usage when extracting text in layout mode with large character offsets.
Who is affected by CVE-2026-48155?
Any users of pypdf versions prior to 6.12.0 are affected by CVE-2026-48155.
Is there a patch for CVE-2026-48155?
Yes, a patch is available in pypdf version 6.12.0 to resolve CVE-2026-48155.