pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b Patch
- https://github.com/py-pdf/pypdf/pull/3891 Issue Tracking, Patch
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · pypdf_projectNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
References 4
- https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b Patch
- https://github.com/py-pdf/pypdf/pull/3891 Issue Tracking, Patch
- https://github.com/py-pdf/pypdf/releases/tag/6.14.1 Product, Release Notes
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr Patch, Vendor Advisory