CVE-2026-59935: pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-25
Weakness: CWE-835

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

Affected products

py-pdf pypdf: before 6.14.2 — fixed in 6.14.2

How to fix

Upgrade to a fixed version: py-pdf pypdf 6.14.2. Check the vendor advisory for mitigations.

References

https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2
https://github.com/py-pdf/pypdf/pull/3892
https://github.com/py-pdf/pypdf/releases/tag/6.14.2
https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q

Get alerted when CVE-2026-59935 or the next vulnerability affects your stack