CVE-2026-48156: pypdf: Possible long runtimes for zero-only width values in cross-reference streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.
Patches
This has been fixed in pypdf==6.12.0.
Workarounds
If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #3791.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.12.0 - Compensating control
If you cannot upgrade immediately, apply the changes from PR #3791 in the py-pdf/pypdf repository as a temporary workaround.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48156?
CVE-2026-48156 is rated medium severity with a CVSS score of 5.1.
How do I fix CVE-2026-48156?
The vulnerability CVE-2026-48156 can be fixed by updating to pypdf version 6.12.0 or later.
What is the impact of CVE-2026-48156?
CVE-2026-48156 can lead to long runtimes when processing specifically crafted PDF files with zero-only width values in cross-reference streams.
Which versions of pypdf are affected by CVE-2026-48156?
All versions of pypdf prior to 6.12.0 are affected by CVE-2026-48156.
Who is affected by CVE-2026-48156?
Users and developers utilizing pypdf versions before 6.12.0 are at risk of encountering issues due to CVE-2026-48156.