{"id":"CVE-2026-48156","aliases":["GHSA-248m-82v9-q6g6","PYSEC-2026-3004"],"title":"pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference …","summary":"pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendor":"pypdf","product":"pypdf","ecosystem":"pip","affected":["pypdf < 6.12.0"],"patched":["pypdf 6.12.0"],"published":"2026-06-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:07.304973624Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6","references":[{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48156"},{"url":"https://github.com/py-pdf/pypdf/pull/3791"},{"url":"https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70"},{"url":"https://github.com/py-pdf/pypdf"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.0"},{"url":"https://github.com/advisories/GHSA-248m-82v9-q6g6"}],"tags":["osv","pip","ghsa"],"epss":0.00124,"epssPercentile":0.02469,"cwe":["CWE-834"],"ingestedAt":"2026-07-07T15:41:59.222Z","slug":"CVE-2026-48156","body":"## Overview\n\n### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values.\n\n### Patches\n\nThis has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0).\n\n### Workarounds\n\nIf developers are unable to upgrade their apps immediately, they should consider applying the changes from PR [#3791](https://github.com/py-pdf/pypdf/pull/3791).\n\n## Affected packages\n\n- `pypdf < 6.12.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pypdf 6.12.0`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201699,"id":"CVE-2026-48156","ts":1789399626350,"field":"severity","old":"medium","new":"low"},{"seq":200431,"id":"CVE-2026-48156","ts":1789397241958,"field":"severity","old":"low","new":"medium"},{"seq":198355,"id":"CVE-2026-48156","ts":1789391864659,"field":"severity","old":"medium","new":"low"},{"seq":196146,"id":"CVE-2026-48156","ts":1789383512692,"field":"severity","old":"low","new":"medium"},{"seq":195075,"id":"CVE-2026-48156","ts":1789380393936,"field":"severity","old":"medium","new":"low"},{"seq":193862,"id":"CVE-2026-48156","ts":1789378364309,"field":"severity","old":"low","new":"medium"},{"seq":192649,"id":"CVE-2026-48156","ts":1789376342721,"field":"severity","old":"medium","new":"low"},{"seq":191436,"id":"CVE-2026-48156","ts":1789373270787,"field":"severity","old":"low","new":"medium"},{"seq":190221,"id":"CVE-2026-48156","ts":1789369227488,"field":"severity","old":"medium","new":"low"},{"seq":189008,"id":"CVE-2026-48156","ts":1789368144556,"field":"severity","old":"low","new":"medium"},{"seq":187791,"id":"CVE-2026-48156","ts":1789365080200,"field":"severity","old":"medium","new":"low"},{"seq":186578,"id":"CVE-2026-48156","ts":1789363129270,"field":"severity","old":"low","new":"medium"},{"seq":185364,"id":"CVE-2026-48156","ts":1789361038513,"field":"severity","old":"medium","new":"low"},{"seq":184151,"id":"CVE-2026-48156","ts":1789358038301,"field":"severity","old":"low","new":"medium"},{"seq":182402,"id":"CVE-2026-48156","ts":1789354161664,"field":"severity","old":"medium","new":"low"},{"seq":181195,"id":"CVE-2026-48156","ts":1789353014330,"field":"severity","old":"low","new":"medium"},{"seq":179988,"id":"CVE-2026-48156","ts":1789350100280,"field":"severity","old":"medium","new":"low"},{"seq":178781,"id":"CVE-2026-48156","ts":1789347963527,"field":"severity","old":"low","new":"medium"},{"seq":177574,"id":"CVE-2026-48156","ts":1789346236751,"field":"severity","old":"medium","new":"low"},{"seq":176367,"id":"CVE-2026-48156","ts":1789342880893,"field":"severity","old":"low","new":"medium"},{"seq":175821,"id":"CVE-2026-48156","ts":1789338663632,"field":"severity","old":"medium","new":"low"},{"seq":175691,"id":"CVE-2026-48156","ts":1789338484097,"field":"severity","old":"low","new":"medium"},{"seq":174486,"id":"CVE-2026-48156","ts":1789334679868,"field":"severity","old":"medium","new":"low"},{"seq":173281,"id":"CVE-2026-48156","ts":1789333365539,"field":"severity","old":"low","new":"medium"},{"seq":172095,"id":"CVE-2026-48156","ts":1789330949265,"field":"severity","old":"medium","new":"low"},{"seq":170909,"id":"CVE-2026-48156","ts":1789328483221,"field":"severity","old":"low","new":"medium"},{"seq":169704,"id":"CVE-2026-48156","ts":1789326992109,"field":"severity","old":"medium","new":"low"},{"seq":168499,"id":"CVE-2026-48156","ts":1789323545500,"field":"severity","old":"low","new":"medium"},{"seq":167294,"id":"CVE-2026-48156","ts":1789319436034,"field":"severity","old":"medium","new":"low"},{"seq":166089,"id":"CVE-2026-48156","ts":1789318428925,"field":"severity","old":"low","new":"medium"},{"seq":164884,"id":"CVE-2026-48156","ts":1789315633167,"field":"severity","old":"medium","new":"low"},{"seq":163679,"id":"CVE-2026-48156","ts":1789313361468,"field":"severity","old":"low","new":"medium"},{"seq":162474,"id":"CVE-2026-48156","ts":1789311763382,"field":"severity","old":"medium","new":"low"},{"seq":161269,"id":"CVE-2026-48156","ts":1789308387295,"field":"severity","old":"low","new":"medium"},{"seq":160774,"id":"CVE-2026-48156","ts":1789304319558,"field":"severity","old":"medium","new":"low"},{"seq":160321,"id":"CVE-2026-48156","ts":1789303886282,"field":"severity","old":"low","new":"medium"},{"seq":159382,"id":"CVE-2026-48156","ts":1789300347448,"field":"severity","old":"medium","new":"low"},{"seq":158612,"id":"CVE-2026-48156","ts":1789299381479,"field":"severity","old":"low","new":"medium"},{"seq":157576,"id":"CVE-2026-48156","ts":1789296529288,"field":"severity","old":"medium","new":"low"},{"seq":156371,"id":"CVE-2026-48156","ts":1789294474387,"field":"severity","old":"low","new":"medium"},{"seq":155166,"id":"CVE-2026-48156","ts":1789292735897,"field":"severity","old":"medium","new":"low"},{"seq":153961,"id":"CVE-2026-48156","ts":1789289448203,"field":"severity","old":"low","new":"medium"},{"seq":152611,"id":"CVE-2026-48156","ts":1789281382843,"field":"severity","old":"medium","new":"low"},{"seq":152251,"id":"CVE-2026-48156","ts":1789280988234,"field":"severity","old":"low","new":"medium"},{"seq":151212,"id":"CVE-2026-48156","ts":1789277483832,"field":"severity","old":"medium","new":"low"},{"seq":150173,"id":"CVE-2026-48156","ts":1789275953581,"field":"severity","old":"low","new":"medium"},{"seq":149140,"id":"CVE-2026-48156","ts":1789273648911,"field":"severity","old":"medium","new":"low"},{"seq":148107,"id":"CVE-2026-48156","ts":1789270991296,"field":"severity","old":"low","new":"medium"},{"seq":146147,"id":"CVE-2026-48156","ts":1789269229138,"field":"severity","old":"medium","new":"low"},{"seq":145049,"id":"CVE-2026-48156","ts":1789266196349,"field":"severity","old":"low","new":"medium"}]}