Is there a patch available for EUVD-2026-32914?

Yes, a patch is available for EUVD-2026-32914. Update the affected software to the latest version immediately.

pypdf EUVD-2026-32914

Q: What is the CVSS score of EUVD-2026-32914?

EUVD-2026-32914 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48155 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-28 GitHub_M

GHSA-cj93-chg6-vgv8

Python Denial Of Service Suse Red Hat

4.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 28, 2026 - 17:51 vuln.today

Analysis Generated

May 28, 2026 - 17:51 vuln.today

Patch available

May 28, 2026 - 17:01 EUVD

CVSS changed

May 28, 2026 - 16:22 NVD

4.8 (MEDIUM)

CVE Published

May 28, 2026 - 14:51 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

AnalysisAI

Memory exhaustion in pypdf prior to 6.12.0 allows an attacker who supplies a crafted PDF to cause large memory consumption in any application that processes it using layout mode text extraction. The vulnerability is triggered by PDFs containing text positioning operators with abnormally large x- or y-coordinate offsets, causing the library to allocate unbounded whitespace and newline characters during rendering. No confirmed active exploitation exists (not in CISA KEV), and SSVC rates this as non-automatable with partial technical impact, placing it in a lower operational priority tier despite the straightforward exploitation mechanic.

Technical ContextAI

pypdf is a pure-Python PDF library (CPE: cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*). The vulnerable code resides in pypdf/_text_extraction/_layout_mode/_fixed_width_page.py, specifically in the recurse_to_target_op and fixed_width_page functions. When layout mode text extraction is used, the library computes horizontal whitespace between characters based on differences in Tm (text matrix) x-coordinate values from the PDF content stream, and vertical spacing from y-coordinate differences. A malicious PDF can encode a Tm operator with an x-coordinate of, for example, 1,000,000 units, causing the library to allocate hundreds of thousands of space characters to represent the visual gap. Similarly, extreme y-coordinate gaps produce millions of newline characters. CWE-400 (Uncontrolled Resource Consumption) precisely describes the root cause: the library applied no upper bound on the amount of whitespace generated, allowing a single PDF operation to drive memory allocation proportional to the coordinate delta. The fix in 6.12.0 introduces WHITESPACE_LIMIT = 10,000 and NEWLINE_LIMIT = 1,000, capping these values with a logged warning.

RemediationAI

Upgrade pypdf to version 6.12.0 or later; this is the vendor-confirmed fix available at https://github.com/py-pdf/pypdf/releases/tag/6.12.0 and documented in advisory GHSA-cj93-chg6-vgv8. The patch introduces hard caps of 10,000 whitespace characters and 1,000 blank lines per layout rendering pass, with warning log output when limits are applied. If an immediate upgrade is not feasible, a targeted workaround is to avoid invoking pypdf's layout mode text extraction (e.g., do not pass extraction_mode='layout' to extract_text) on untrusted PDF input - default extraction mode does not exercise the vulnerable code path, though this may reduce output fidelity for layout-sensitive use cases. As a defense-in-depth measure for server-side processing, apply per-process memory limits using OS-level controls (Linux cgroups memory.limit_in_bytes, or ulimit -v) to bound the blast radius of any single malicious PDF; note this does not prevent the DoS but limits its scope to the constrained process. Input file size restrictions can also reduce exposure by limiting the number of crafted Tm operators that can be embedded.