Most recent entries from all

CVE-2026-59936 — pypdf: Possible infinite loop for not terminated inline images

2026-09-30T16:15:55.625425+00:00

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

GHSA-5xf7-4p34-54qr — pypdf: Possible infinite loop for not terminated inline images

2026-09-30T16:15:55.625536+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.

### Patches

This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891).