Allocation of Resources Without Limits or Throttling in PyPDF - CVE-2026-48735
Published: May 25, 2026
Vulnerability identifier: #VU132250
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48735
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption.
The vulnerability exists due to allocation of resources without limits or throttling in the XMP metadata parser when parsing large XMP metadata streams in a PDF file. A remote attacker can supply a specially crafted PDF file to cause excessive memory consumption.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-48735
Install security update from vendor's website.
PyPDF - update to 6.12.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2