CVE-2026-49460: pypdf: Inefficient decoding of FlateDecode PNG predictor streams
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.
Patches This has been fixed in pypdf==6.12.2.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3806.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.12.2 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.12.2 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3806] referenced as the workaround for pypdf FlateDecode PNG predictor long-runtime issue.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49460?
CVE-2026-49460 has a risk score of 22, indicating a high level of severity.
What vulnerability does CVE-2026-49460 describe?
CVE-2026-49460 describes a vulnerability where an attacker can craft a PDF that leads to long runtimes.
How do I fix CVE-2026-49460?
To fix CVE-2026-49460, update to pypdf version 6.12.2 or later.
What type of filter is exploited in CVE-2026-49460?
CVE-2026-49460 exploits a stream that uses the `/FlateDecode` filter with a PNG predictor.
When was CVE-2026-49460 published?
CVE-2026-49460 was published on June 16, 2026.