Skip to content

Possible long runtimes for zero-only width values in cross-reference streams

Moderate
stefan6419846 published GHSA-248m-82v9-q6g6 May 21, 2026

Package

pip pypdf (pip)

Affected versions

< 6.12.0

Patched versions

>= 6.12.0

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3791.

Credits

  • Thai Son Dinh from VinSOC Labs (R&D)

Severity

Moderate

CVE ID

CVE-2026-48156

Weaknesses

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. Learn more on MITRE.

Credits