PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48735 py-pdf CVE debrief

A memory consumption vulnerability exists in pypdf versions prior to 6.12.1. An attacker can craft a PDF with large XMP metadata containing excessive unnecessary elements, causing significant memory usage during parsing. This represents a denial-of-service condition through resource exhaustion. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The issue was resolved in pypdf 6.12.1, which implements proper handling of XMP metadata to prevent unbounded memory growth.

Vendor
py-pdf
Product
pypdf
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations using pypdf for PDF processing in server-side applications, document management systems, or automated workflows where untrusted PDFs are ingested. Particularly relevant for services processing user-uploaded documents.

Technical summary

The vulnerability stems from insufficient resource limits when parsing XMP (Extensible Metadata Platform) metadata in PDF files. XMP metadata can contain arbitrarily large XML structures with nested elements. Without proper size constraints or streaming parsing, processing maliciously constructed metadata leads to unbounded memory allocation. The fix in 6.12.1 likely implements parsing limits or streaming processing to bound memory consumption.

Defensive priority

medium

Recommended defensive actions

  • Upgrade pypdf to version 6.12.1 or later
  • Implement input validation to limit PDF file sizes and metadata complexity before processing
  • Monitor memory usage when processing untrusted PDF documents
  • Consider sandboxing PDF processing operations with resource limits
  • Review applications using pypdf for XMP metadata extraction capabilities

Evidence notes

CVE published 2026-05-28. CVSS 4.0 vector indicates local attack vector with high availability impact. Fix confirmed via GitHub security advisory GHSA-wjqc-6w8f-h24c and release 6.12.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.