pypdf possibly loops infinitely when reading DCT inline images without EOF marker

高危 7.5CVE-2025-62707 · GHSA-vr63-x8vc-m265 · PYSEC-2026-1833 · Published 22/10/2025 · updated 02/11/2026

要点

CVE-2025-62707 是影响 pypdf, pypdf (py-pdf) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.44%，高于 38.6% 的漏洞。
修复：升级到 6.1.3 或更高版本。

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.1.3`	`6.1.3`
pypdf py-pdf	`< 6.1.3`	`6.1.3`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3501.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.

References

py-pdf/pypdf security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-62707 · ADVISORY
py-pdf/pypdf#3501 · WEB
py-pdf/pypdf commit f2864d6 · WEB
py-pdf/pypdf · PACKAGE
py-pdf/pypdf release 6.1.3 · WEB
pypi.org/project/pypdf · PACKAGE
GitHub Advisory GHSA-vr63-x8vc-m265 · ADVISORY

pypdf 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pypdf

PyPI

< 6.1.3

6.1.3

pypdf

py-pdf

< 6.1.3

6.1.3

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3501.

NVD description

pypdf 的其他漏洞

查看全部 →