4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48155

CVE-2026-48155: pypdf: Possible large memory usage for large offsets for layout mode text

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48155

CVE-2026-48155:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.12.0	6.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-48155, allows an attacker to cause a denial-of-service by crafting a PDF that consumes a large amount of memory during text extraction in layout mode. The root cause lies in the processing of text positioning operators within the PDF content. The pypdf library's layout mode text extraction feature calculates the amount of whitespace (spaces and newlines) to generate based on coordinate values in the PDF. The vulnerability is that there were no limits on these calculated values.

Analysis of the patch in PR #3790 reveals two key functions where the vulnerability is present and was subsequently fixed:

recurse_to_target_op (renamed from recurs_to_target_op): This function processes text drawing commands. It was vulnerable because the calculation for the number of spaces (spaces) between text fragments could be manipulated to be a very large number, leading to the allocation of a huge string.
fixed_width_page: This function builds the final text page layout. It was vulnerable in two ways: first, by calculating the number of blank_lines between text based on vertical positioning, and second, by calculating needed_spaces for horizontal alignment. Both calculations could result in extremely large numbers when processing a malicious PDF.

The patch addresses these issues by introducing WHITESPACE_LIMIT and NEWLINE_LIMIT to cap the number of spaces and newlines that can be generated, thus preventing uncontrolled memory allocation.

Vulnerable functions

recurse_to_target_op

pypdf/_text_extraction/_layout_mode/_fixed_width_page.py

This function, renamed from `recurs_to_target_op` in the patch, processes text showing operations from a PDF's content stream. It calculates the number of spaces to insert between text elements. A malicious PDF could use large coordinates to make the `spaces` variable extremely large, causing the application to allocate a massive string, leading to high memory consumption and a potential denial of service. The patch mitigates this by introducing `WHITESPACE_LIMIT` to cap the number of spaces.

fixed_width_page

pypdf/_text_extraction/_layout_mode/_fixed_width_page.py

This function arranges extracted text into a fixed-width layout. It calculates the number of `blank_lines` to insert based on vertical coordinates. A crafted PDF can manipulate these coordinates to cause a very large number of blank lines to be generated, consuming excessive memory. The patch adds a `NEWLINE_LIMIT` to prevent this. A similar issue exists with `needed_spaces` within the same function, which is also capped.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.