pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

높음 7.5CVE-2026-59935 · GHSA-g867-7843-wf8q · PYSEC-2026-3613 · Published 08/07/2026 · updated 25/10/2026

요약

CVE-2026-59935은(는) pypdf, pypdf (pypdf project)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.62%, 전체 취약점의 49.7%보다 높음.
조치: 6.14.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.14.2`	`6.14.2`
pypdf pypdf_project	`< 6.14.2`	`6.14.2`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3892.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

References

py-pdf/pypdf security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-59935 · ADVISORY
py-pdf/pypdf#3892 · WEB
py-pdf/pypdf commit 5a33a46 · WEB
py-pdf/pypdf · PACKAGE
py-pdf/pypdf release 6.14.2 · WEB
pypi.org/project/pypdf · PACKAGE
GitHub Advisory GHSA-g867-7843-wf8q · ADVISORY

pypdf의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pypdf

PyPI

< 6.14.2

6.14.2

pypdf

pypdf_project

< 6.14.2

6.14.2

Description

Impact

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3892.

NVD description

pypdf의 다른 취약점

모두 보기 →