pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

高 7.5CVE-2026-59935 · GHSA-g867-7843-wf8q · PYSEC-2026-3613 · 08/07/2026 公開 · 25/10/2026 更新

要点

CVE-2026-59935 は pypdf, pypdf (pypdf project) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.62%（全脆弱性の 49.7% より高い）。
対処：6.14.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pypdf PyPI	`< 6.14.2`	`6.14.2`
pypdf pypdf_project	`< 6.14.2`	`6.14.2`

概要

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3892.

NVD の説明

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.