ZeroDay Findings
Sign inSign up

Findings

CVE-2026-48735

pypdf is a free and open-source pure-python PDF library.

Published May 28, 2026 · updated Oct 14, 2026 · pypdf project pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

Timeline

Detection, updates, and resolution for this record.

  1. May 28, 2026 · NIST NVD

    Detected

    pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

  2. Oct 14, 2026 · NIST NVD

    Updated

    pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

Affected

  • cpe pypdf project/pypdfversion unspecified

Sources

  • CVE.orgCVE-2026-48735

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-48735

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDCVE-2026-48735

    pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed i

    nvd.nist.gov

References