CVE-2025-62708

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality (Vulnerable System)

None

Integrity (Vulnerable System)

None

Availability (Vulnerable System)

High

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

Unchanged

Affected products

py-pdf / pypdf< 6.1.3 – < 6.1.3

References

VENDOR_ADVISORYhttps://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j
PATCHhttps://github.com/py-pdf/pypdf/pull/3502
PATCHhttps://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da
PATCHhttps://github.com/py-pdf/pypdf/releases/tag/6.1.3