Resource exhaustion in PyPDF - CVE-2026-48155
Published: May 21, 2026
Vulnerability identifier: #VU132045
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48155
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption.
The vulnerability exists due to uncontrolled resource consumption in the text extraction layout mode when processing a crafted PDF with large character offsets. A remote attacker can supply a specially crafted PDF to cause excessive memory consumption.
Exploitation requires text extraction to be performed in layout mode.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-48155
Install security update from vendor's website.
PyPDF - update to 6.12.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2