CVE-2025-62707

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality (Vulnerable System)

None

Integrity (Vulnerable System)

None

Availability (Vulnerable System)

High

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

Unchanged

Affected products

py-pdf / pypdf< 6.1.3 – < 6.1.3

References

VENDOR_ADVISORYhttps://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265
PATCHhttps://github.com/py-pdf/pypdf/pull/3501
PATCHhttps://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8
PATCHhttps://github.com/py-pdf/pypdf/releases/tag/6.1.3