How severe is CVE-2026-49460?

CVE-2026-49460 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-49460 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-49460?

CVE-2026-49460 affects Pypdf Project Pypdf. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-49460?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-49460 have an EU (EUVD) identifier?

Yes. CVE-2026-49460 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38357.

When was CVE-2026-49460 published?

CVE-2026-49460 was published on 2026-06-22 and last updated on 2026-06-25.

CVE-2026-49460

CVE-2026-49460 is a low-severity vulnerability in Pypdf Project Pypdf with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-407.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v4: 5.1
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38357
Weakness: CWE-407
Affected product: Pypdf Project Pypdf
Published: 2026-06-22
Last modified: 2026-06-25

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

Frequently asked questions

What is CVE-2026-49460?: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.
How severe is CVE-2026-49460?: CVE-2026-49460 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-49460 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-49460?: CVE-2026-49460 affects Pypdf Project Pypdf. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-49460?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-49460 have an EU (EUVD) identifier?: Yes. CVE-2026-49460 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38357.
When was CVE-2026-49460 published?: CVE-2026-49460 was published on 2026-06-22 and last updated on 2026-06-25.

References

Affected products (1)

cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*

More vulnerabilities in Pypdf Project Pypdf

CVE-2026-103000 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large…
CVE-2026-102999 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files…
CVE-2026-102998 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can…
CVE-2026-102997 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially…
CVE-2026-102996 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1…
CVE-2026-102995 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large…

All CVEs affecting Pypdf Project Pypdf →

Other CWE-407 vulnerabilities

CVE-2026-16762 — High (CVSS 8.7): An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate…
CVE-2026-114143 — High (CVSS 8.7): toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins…
CVE-2026-114141 — High (CVSS 8.7): toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray()…
CVE-2026-112894 — High (CVSS 8.7): Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object…
CVE-2026-107378 — High (CVSS 8.7): CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled…
CVE-2026-94658 — High (CVSS 8.7): Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift:…

Browse all CWE-407 vulnerabilities →