Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-28T14:51:49 pypdf: pypdf: Denial of Service via crafted PDF with large character offsets 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-770

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive memory consumption. This occurs when extracting text in layout mode with large character offsets. This vulnerability can result in a Denial of Service (DoS) due to large memory usage.

This Moderate-impact flaw in pypdf can lead to a denial of service in Red Hat products that process untrusted PDF files. The vulnerability, triggered by specially crafted PDFs during text extraction with large character offsets, can cause excessive memory consumption. This affects Red Hat Quay, Red Hat Enterprise Linux AI, OpenShift Lightspeed, Exploit Intelligence, and Red Hat Ansible Automation Platform. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llama-stack-core-rhel9 Red Hat Quay 3 Fix deferred quay/quay-rhel8 Red Hat Quay 3 Fix deferred quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-48155 https://nvd.nist.gov/vuln/detail/CVE-2026-48155 https://github.com/py-pdf/pypdf/pull/3790 https://github.com/py-pdf/pypdf/releases/tag/6.12.0 https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8