CVE-2026-40260 py-pdf CVE debrief

Who should care

Defenders responsible for PDF processing and parsing, as well as developers using the pypdf library, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and monitoring PDF parsing and processing in their environment, considering implementing memory limits and monitoring for PDF processing tasks, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2026-40260 is a vulnerability in the pypdf library that can lead to large memory usage when parsing manipulated XMP metadata entity declarations. Defenders should prioritize updating to version 6.10.0 or later to prevent potential memory exhaustion attacks. This vulnerability may impact PDF processing and parsing tasks, and defenders responsible for these tasks should be aware of the potential risks.

• Potential memory exhaustion leading to denial-of-service conditions
• Increased risk of memory-related issues in PDF processing tasks
• Need for verification of pypdf version and vulnerability status

Technical summary

The pypdf library is vulnerable to a memory exhaustion attack when parsing manipulated XMP metadata entity declarations. This can lead to large memory usage, potentially causing a denial-of-service condition. The vulnerability is caused by manipulated XMP metadata entity declarations that can exhaust RAM. An attacker can craft a PDF that leads to large memory usage, requiring parsing of the XMP metadata. This issue has been fixed in version 6.10.0. Defenders should prioritize updating to version 6.10.0 or later to prevent potential memory exhaustion attacks.

Defensive priority

Defenders should prioritize updating to version 6.10.0 or later to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Update to pypdf version 6.10.0 or later
• Review and monitor PDF parsing and processing in your environment
• Consider implementing memory limits and monitoring for PDF processing tasks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by manipulated XMP metadata entity declarations that can exhaust RAM. An attacker can craft a PDF that leads to large memory usage, requiring parsing of the XMP metadata. This requires parsing the XMP metadata. The issue has been fixed in version 6.10.0. Evidence is limited to public statements from the vendor and CVE Program.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.