VulnerabilityAnalyzed

CVE-2026-40260

An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage.

MEDIUM 6.9EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.42% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-776
Affected: pypdf project/pypdf
Source: security-advisories@github.com

References

https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8Patch
https://github.com/py-pdf/pypdf/pull/3724Issue Tracking, Patch
https://github.com/py-pdf/pypdf/releases/tag/6.10.0Product, Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mxMitigation, Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.