Search/CVE-2026-40260
● CVE — Medium

CVE-2026-40260

Vendorpypdf projectProductpypdfDiscoveredApr 17, 2026UpdatedApr 22, 2026

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.

View graph Watch Export
CVSS v3.1
5.3 MEDIUM
EPSS
0.42%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 25, 2026 → Oct 26, 2026
▼ 0.09pp
0.52% → 0.42% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityLOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Connections
2 relationships
Timeline
disclosure → media coverage
Apr 17, 2026
Disclosure — published as a CVE record. · last revised by NVD Apr 22, 2026