CVE-2026-59935
HIGHpypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Title source: cnaDescription
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q
X_Refsource_Misc x_refsource_misc
https://github.com/py-pdf/pypdf/pull/3892
X_Refsource_Misc x_refsource_misc
https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2
X_Refsource_Misc x_refsource_misc
https://github.com/py-pdf/pypdf/releases/tag/6.14.2
Scores
CVSS v3
7.5
EPSS
0.0037
EPSS Percentile
29.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-835
Status
published
Products (3)
py-pdf/pypdf
< 6.14.2
pypdf_project/pypdf
< 6.14.2
pypi/pypdf
0 - 6.14.2PyPI
Published
Jul 08, 2026
Tracked Since
Jul 09, 2026