Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-11 | 1 | Disclosure1 |
| 2026-04-17 | 2 | Disclosure2 |
CVE-2026-40260 pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who ex… https://www.cve.org/CVERecord?id=CVE-2026-40260
Post summary
The post announces that CVE‑2026‑40260 in pypdf allows memory exhaustion through manipulated XMP metadata in versions before 6.10.0.
CVE-2026-40260 Memory Exhaustion in pypdf Prior to Version 6.10.0 via XMP Metadata https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40260
Post summary
The text announces a memory exhaustion vulnerability (CVE-2026-40260) in pypdf prior to v6.10.0 via XMP metadata, offering a technical description but no PoC, exploit, patch, or report of active exploitation.
🟠 pypdf, Memory Exhaustion, #CVE-2026-40260 (Moderate) https://dailycve.com/pypdf-memory-exhaustion-cve-2026-40260-moderate/
Post summary
The content announces a new CVE for a memory exhaustion vulnerability in pypdf, indicating moderate severity, but provides no evidence of exploits, PoCs, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pypdf_project | pypdf | - | - | - |