CVE-2026-48155: pypdf: Possible large memory usage for large offsets for layout mode text
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.
Patches
This has been fixed in pypdf==6.12.0.
Workarounds
If developers are unable to immediately upgrade, they should consider applying the changes from PR #3790.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.12.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.12.0Patch pypdf==6.12.0 - Compensating control
If developers cannot immediately upgrade, apply the changes from PR [#3790] (py-pdf/pypdf pull request 3790) to mitigate large memory usage when extracting text in layout mode with large character offsets prior to 6.12.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48155?
The severity of CVE-2026-48155 is medium with a CVSS score of 4.8.
How do I fix CVE-2026-48155?
To fix CVE-2026-48155, upgrade to pypdf version 6.12.0 or later.
What impact does CVE-2026-48155 have on systems using pypdf?
CVE-2026-48155 can lead to large memory usage when extracting text in layout mode with large character offsets.
Who is affected by CVE-2026-48155?
Any users of pypdf versions prior to 6.12.0 are affected by CVE-2026-48155.
Is there a patch for CVE-2026-48155?
Yes, a patch is available in pypdf version 6.12.0 to resolve CVE-2026-48155.