CVE-2026-48735: pypdf resource exhaustion via manipulated XMP metadata

Executive brief

A vulnerability in the pypdf library, which is used to process PDF files, allows an attacker to crash applications or exhaust system memory. By providing a specially crafted PDF with malicious metadata, an attacker can cause the system to consume excessive RAM, potentially leading to a service outage or system instability. This could impact any business process that automatically parses or handles user-uploaded PDF documents.

Technical details

The pypdf library is vulnerable to a resource exhaustion (CWE-770) issue when parsing XMP metadata. An attacker can craft a PDF containing a large XMP metadata stream with numerous unnecessary elements that, when processed, causes the library to allocate excessive amounts of RAM. This is a local attack vector requiring the library to parse a malicious file, resulting in a high impact on system availability (Denial of Service). The issue is resolved in version 6.12.1 by implementing better resource limits during metadata parsing.

Affected products

• py-pdf pypdf < 6.12.1

Timeline

• 2026-05-22: disclosed: Initial report by stefan6419846
• 2026-05-28: advisory: NVD publication date
• 2026-06-16: patched: GitHub Advisory reviewed and updated with patch information

References

• https://api.github.com/users/manop55555
• https://github.com/manop55555
• https://api.github.com/users/manop55555/gists%7B/gist_id%7D
• https://api.github.com/users/manop55555/repos
• https://avatars.githubusercontent.com/u/109808848?v=4
• https://api.github.com/users/manop55555/events%7B/privacy%7D