CVE-2026-49460

Analyzed Analyzed - Analysis Complete

Remote Code Execution Risk in PyPDF via FlateDecode Filter

Publication date: 2026-06-22

Last updated on: 2026-06-25

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-25

Generated

2026-07-13

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2026-49460

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.12.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.12.2, an attacker could craft a specially designed PDF file that triggers long runtimes when processed. This happens by exploiting a stream that uses the /FlateDecode filter combined with a PNG predictor.

The issue is fixed in version 6.12.2 of pypdf.

Impact Analysis

The vulnerability can cause long runtimes when processing maliciously crafted PDF files. This could lead to performance degradation or denial of service conditions in applications using vulnerable versions of pypdf.

Mitigation Strategies

To mitigate this vulnerability, update the pypdf library to version 6.12.2 or later, where the issue has been fixed.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability involves processing specially crafted PDF files that use the /FlateDecode filter with a PNG predictor, causing long runtimes in the pypdf library versions prior to 6.12.2.

Detection can be approached by identifying PDF files that contain streams using the /FlateDecode filter with PNG predictors and monitoring for unusually long processing times or high resource usage when these PDFs are handled by pypdf.

Since the vulnerability is triggered by crafted PDFs, scanning your system or network for PDF files with such characteristics could help detect potential exploitation attempts.

No specific commands are provided in the available resources, but you can use PDF analysis tools or scripts to inspect PDF streams for the /FlateDecode filter combined with PNG predictors.

Additionally, monitoring logs or system behavior for unusually long runtimes or high CPU usage during PDF processing with pypdf versions prior to 6.12.2 may indicate exploitation.

Hi! I’m here to help you understand CVE-2026-49460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70