CVE-2026-49460

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

Published Jun 22, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

Analysis

Technical impact

Prior to version 6.12.2, the pypdf library inefficiently decodes streams that use the /FlateDecode filter with a PNG predictor, causing long runtimes when processing a malicious PDF. The vulnerability is a CWE‑407 efficiency issue and a CWE‑770 resource exhaustion weakness, and can lead to denial of service by exhausting CPU or memory resources, potentially affecting application availability.

Affected Systems

The Python PDF library pypdf is affected. Versions earlier than 6.12.2 are vulnerable. Updating to 6.12.2 or later resolves the issue.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is 0.00125, indicating an extremely low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a crafted PDF to an application that imports or parses PDFs with pypdf; the exploit requires no privileged access and does not gain code execution, but can cause high CPU usage spikes and is a resource exhaustion vulnerability (CWE‑770), potentially leading to service outages.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

py-pdf

pypdf

affected

Version	Status	Constraints
`< 6.12.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Py-pdf

Pypdf

Version	Status	Scheme	Platform
`[0,6.12.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pypdf to version 6.12.2 or later.
Restrict access to the PDF parsing functionality to trusted inputs and validate PDF files before processing.
Implement monitoring for CPU usage spikes during PDF handling and set thresholds to trigger alerts or throttling.

Generated by OpenCVE AI on June 25, 2026 at 13:53 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-5hgr-hg42-57jg	pypdf: Inefficient decoding of FlateDecode PNG predictor streams

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.166% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/py-pdf/pypdf/pull/3806
https://github.com/py-pdf/pypdf/releases/tag/6.12.2
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
https://nvd.nist.gov/vuln/detail/CVE-2026-49460
https://www.cve.org/CVERecord?id=CVE-2026-49460

History

Nov 2, 2026 4:15 PM Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:pypdf_project:pypdf::::::::	cpe:2.3:a:py-pdf:pypdf::::::::
Vendors & Products	Pypdf Project Pypdf Project pypdf

Jun 25, 2026 12:45 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-49460 https://www.cve.org/CVERecord?id=CVE-2026-49460
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 23, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 1:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Py-pdf Py-pdf pypdf
Vendors & Products		Py-pdf Py-pdf pypdf

Jun 22, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.
Title		pypdf: Inefficient decoding of FlateDecode PNG predictor streams
Weaknesses		CWE-407
References		https://github.com/py-pdf/pypdf/pull/3806 https://github.com/py-pdf/pypdf/releases/tag/6.12.2 https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`