pypdf CVE-2026-48156

The target application must use pypdf < 6.12.0 to parse a PDF file controlled by the attacker. The CVSS vector PR:N/UI:N indicates no authentication and no user interaction are required beyond the application's normal file-processing workflow. The specific triggering condition is a PDF containing a cross-reference stream where the /W array sums to zero (e.g., /W [0 0 0]) combined with a large /Size value. No non-default configuration of pypdf is required; the vulnerability exists in the default (non-strict) parsing mode. Exploitation is limited to availability impact (long runtimes) and does not achieve code execution or data disclosure. Applications that do not process untrusted or externally supplied PDF files are not exposed.

The CVSS 4.0 base score is 5.1 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. The local attack vector (AV:L) reflects that exploitation requires the attacker to supply a file that is processed on the system rather than attacking a bound network socket; however, this rating understates real-world risk for web applications that accept PDF uploads, where the equivalent network delivery path exists. The VA:L (Low availability on the vulnerable system) score is consistent with degraded performance or hanging rather than a full crash. No EPSS score was provided in the intelligence data. There is no KEV listing and no public proof-of-concept identified. Notably, the ENISA EUVD tags label this 'Information Disclosure,' which directly conflicts with the description and CVSS impact metrics (VC:N/VI:N), and with CWE-834; this tag appears to be a mislabeling and should not factor into risk decisions. Real-world priority should be moderate for any service processing untrusted PDFs at scale, where sustained high-volume submission could exhaust worker processes.

An attacker crafts a minimal PDF containing a cross-reference stream with /W [0 0 0] and a /Size set to a very large integer (e.g., 50,000,000 as demonstrated in the updated test suite). The attacker submits this file to any service or script that calls pypdf to parse or inspect PDF content - such as a document conversion API, a web form that accepts PDF uploads, or a CI pipeline that processes PDF artifacts. The pypdf parser enters an excessive iteration loop attempting to read the declared number of zero-byte XRef entries, causing the processing thread or worker to hang for an extended period, degrading or denying service.