Skip to content

Possible infinite loop when reading DCT inline images without EOF marker

Moderate
stefan6419846 published GHSA-vr63-x8vc-m265 Oct 22, 2025

Package

pip pypdf (pip)

Affected versions

< 6.1.3

Patched versions

>= 6.1.3

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3501.

Severity

Moderate

CVE ID

CVE-2025-62707

Weaknesses

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. Learn more on MITRE.

Credits