~ / search / GHSA-g867-7843-wf8q

GHSA-g867-7843-wf8q

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Source: GitHub Advisory Database (reviewed) High CVE-2026-59935

Packages

EcosystemPackageAffectedFixed in
PyPI pypdf < 6.14.2 6.14.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. ### Patches This has been fixed in [pypdf==6.14.2](https://github.com/py-pdf/pypdf/releases/tag/6.14.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3892](https://github.com/py-pdf/pypdf/pull/3892).

References

External links from the advisory. They lead to third-party sites.