CVE-2026-49461: pypdf: Possible large memory usage for form XObjects during text extraction
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.
Patches This has been fixed in pypdf==6.12.2.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3805.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.12.2 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.12.2 - Configuration
If you cannot upgrade yet (prior to 6.12.2), apply the changes from PR [#3805](https://github.com/py-pdf/pypdf/pull/3805) to mitigate large memory usage during text extraction involving form XObjects with self-references.
pypdf Apply PR #3805 workaround = From PR [#3805]
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49461?
The severity of CVE-2026-49461 is rated as 26, indicating a significant risk to affected systems.
How do I fix CVE-2026-49461?
To fix CVE-2026-49461, update your pypdf library to version 6.12.2 or later.
What type of vulnerability is CVE-2026-49461?
CVE-2026-49461 is a memory usage vulnerability that can be exploited through crafted PDF files.
What systems are affected by CVE-2026-49461?
CVE-2026-49461 affects systems using the pypdf library for PDF handling.
What can an attacker do with CVE-2026-49461?
An attacker can exploit CVE-2026-49461 by crafting a PDF that leads to excessive memory usage during text extraction.