CVE-2026-49461: pypdf Memory Exhaustion Vulnerability – Patch to 6.12.2

Technical summary

The vulnerability exists in pypdf's text extraction functionality when processing PDF form XObjects (referenced content streams) that contain self-referential structures. During text extraction, the library does not adequately limit recursion or memory allocation when traversing these circular references, resulting in unchecked heap allocation. An attacker-supplied PDF exploiting this condition will cause the application process to consume available system memory until the process terminates or the system becomes unresponsive. The issue is classified as CWE-400 (Uncontrolled Resource Consumption), and the attack vector requires local or direct file access rather than remote network exploitation.

Business impact

For organizations relying on pypdf for batch PDF processing, document automation, or embedded text extraction workflows, this vulnerability creates operational risk through resource exhaustion. A single malicious PDF could cause service interruptions or denial of service in applications that process untrusted PDF documents without memory limits. Data integrity is not compromised, but availability can be significantly degraded. The impact is particularly relevant for organizations handling user-submitted PDFs, web-based document conversion services, or automated compliance scanning tools that parse PDF content.

Affected systems

pypdf versions prior to 6.12.2 are affected. The library is commonly used in Python environments across data extraction, document processing, and integration workflows. Any application or service that uses an older version of pypdf and calls text extraction methods on untrusted PDF input is at risk. This includes both direct pypdf usage and indirect dependencies within larger document processing frameworks.

Exploitability

Exploitation requires an attacker to deliver a crafted PDF file to a target application or user. The CVSS vector indicates a local attack vector with low complexity and no user interaction required beyond opening or processing the file. However, practical exploitation depends on the application's threat model: if pypdf processes PDFs from trusted sources only, risk is lower; if it handles user-uploaded or internet-sourced documents, risk is substantially higher. No public exploit code or active weaponization is currently tracked, but the vulnerability is straightforward to exploit given its nature.

Remediation

Organizations should upgrade pypdf to version 6.12.2 or later. For applications that cannot immediately upgrade, implement defensive measures such as running PDF processing in isolated processes with enforced memory limits, avoiding text extraction on untrusted PDFs, or sandboxing document processing workflows. If pypdf is a transitive dependency, verify that dependent packages are also updated to require the patched version.

Patch guidance

Upgrade pypdf to 6.12.2 or later. Use your package manager (pip, poetry, conda) to update: pip install --upgrade pypdf>=6.12.2. Verify the installed version with pip show pypdf. If pypdf is specified in requirements.txt or setup.py, update constraints to enforce the minimum version. Test the upgrade in a staging environment with your existing PDF processing workflows to ensure compatibility. Monitor vendor advisories for any subsequent security patches.

Detection guidance

Log and monitor PDF processing operations, especially those involving text extraction. Alert on processes consuming unexpectedly high memory during PDF operations, or on crashes of PDF-processing applications. In code repositories, scan for pypdf versions earlier than 6.12.2 using dependency analysis tools (e.g., safety, pip-audit, SBOM analysis). Monitor for PDF files with unusual or recursive form XObject references if handling file uploads. Endpoint detection can flag memory exhaustion patterns consistent with denial-of-service attacks.

Why prioritize this

Although the CVSS score is moderate (5.5), this vulnerability should be prioritized based on scope: any organization processing untrusted PDFs faces real availability risk. Patching is straightforward and low-risk. The lack of KEV status reflects its recent publication and limited exploitation tracking, but does not diminish operational relevance for affected users. Prioritize based on your organization's exposure to user-supplied or internet-sourced PDF content.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, and high impact on availability—but no impact on confidentiality or integrity. The score appropriately captures the denial-of-service nature of the vulnerability. Organizations processing untrusted PDFs may reasonably treat this as higher priority within their context, as availability impact can be severe in production systems.

Frequently asked questions