XML Entity Expansion in PyPDF - CVE-2026-40260
Published: April 10, 2026
Vulnerability identifier: #VU125811
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40260
CWE-ID: CWE-776
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption.
The vulnerability exists due to improper restriction of recursive entity references in DTDs in the XMP metadata parser when parsing XMP metadata from a PDF file. A remote attacker can supply a specially crafted PDF to cause excessive memory consumption.
Exploitation requires the application to parse the XMP metadata.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-40260
Install security update from vendor's website.
PyPDF - update to 6.10.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2