PT-2017-4246 · Python+5 · Pypdf2+5

Sebastian Krause

·

Published

2017-02-17

·

Updated

2026-04-17

·

CVE-2022-24859

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions PyPDF2 versions prior to 1.27.5
Description The issue is related to the ContentStream. readInlineImage function in the PyPDF2 library, which can lead to an infinite loop if an attacker crafts a PDF that causes the code to attempt to get the content stream without properly checking if the stream has already ended. This can be exploited by a remote attacker to cause a denial of service using a specially created PDF file. The reason for this issue is that the last while-loop in ContentStream. readInlineImage only terminates when it finds the EI token, but never actually checks if the stream has already ended.
Recommendations For versions prior to 1.27.5, upgrade to version 1.27.5 or later to resolve the issue. As a temporary workaround, consider validating PDFs prior to iterating over their content stream to minimize the risk of exploitation.

Exploit

Fix

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2022-1772
BDU:2023-02632
CVE-2022-24859
DLA-3039-1
DLA-3451-1
GHSA-XCJX-M2PJ-8G79
MGASA-2022-0224
OPENSUSE-SU-2024:0366-1
PYSEC-2022-194
USN-6176-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Pypdf2
Red Os
Ubuntu