Skip to content

Possible large memory usage for form XObjects during text extraction

Moderate
stefan6419846 published GHSA-j543-4vmf-qm7v May 26, 2026

Package

pip pypdf (pip)

Affected versions

< 6.12.2

Patched versions

>= 6.12.2

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3805.

Severity

Moderate

CVE ID

CVE-2026-49461

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource. Learn more on MITRE.

Credits