5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49460

CVE-2026-49460: pypdf: Inefficient decoding of FlateDecode PNG predictor streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49460

CVE-2026-49460:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.12.2	6.12.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the inefficient implementation of the _decode_png_prediction function in pypdf/filters.py. The analysis of the provided patch in commit 12cd39367cb767cf3e4a0e131fde017cac5e8d27 clearly shows a performance optimization. The original code used Python lists ([]) and list comprehensions to process pixel data from a PNG stream. This is notoriously slow for large binary data. The patch replaces this with bytearray, a data structure specifically designed for efficient mutable sequence of bytes. This change directly addresses the vulnerability described as 'Inefficient decoding of FlateDecode PNG predictor streams', which could lead to long runtimes and a denial-of-service vulnerability. The added test case with a 5-second timeout, where it previously took 20 seconds, further confirms that this was a performance-related security fix.

Vulnerable functions

_decode_png_prediction

pypdf/filters.py

The function `_decode_png_prediction` used Python lists for byte manipulation, which is highly inefficient. When processing a specially crafted PDF with a large image using PNG prediction in a Flate-decoded stream, this inefficiency could be exploited to cause a denial of service due to excessive CPU and memory consumption. The patch replaces the use of lists with the more performant `bytearray` and `bytes` types.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.