---
id: CVE-2026-48156
aliases:
  - GHSA-248m-82v9-q6g6
  - PYSEC-2026-3004
title: >-
  pypdf: Possible long runtimes for zero-only width values in cross-reference
  streamsuntimes for zero-only width values in cross-reference …
summary: >-
  pypdf: Possible long runtimes for zero-only width values in cross-reference
  streamsuntimes for zero-only width values in cross-reference streams
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
vendor: pypdf
product: pypdf
ecosystem: pip
affected:
  - pypdf < 6.12.0
patched:
  - pypdf 6.12.0
published: '2026-06-12'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:07.304973624Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6'
references:
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48156'
  - url: 'https://github.com/py-pdf/pypdf/pull/3791'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70
  - url: 'https://github.com/py-pdf/pypdf'
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.12.0'
  - url: 'https://github.com/advisories/GHSA-248m-82v9-q6g6'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00172
epssPercentile: 0.05799
cwe:
  - CWE-834
ingestedAt: '2026-07-07T15:41:59.222Z'
---

## Overview

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values.

### Patches

This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0).

### Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR [#3791](https://github.com/py-pdf/pypdf/pull/3791).

## Affected packages

- `pypdf < 6.12.0`

## Remediation

Upgrade to a patched release:

- `pypdf 6.12.0`