PT-2023-29930 · Pypi · Pypdf

Alex Huszagh · CVE-2023-46250 · Published 2023-10-31 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pypdf versions 3.7.0 through 3.16.4

Description The issue allows an attacker to craft a PDF that leads to an infinite loop, blocking the current process and utilizing a single core of the CPU by 100%. This does not affect memory usage and can occur when a user manipulates an incoming malicious PDF, for example, by merging it with another PDF or by adding annotations.

Recommendations For versions 3.7.0 through 3.16.4, update to version 3.17.0 to resolve the issue. As a temporary workaround for versions 3.7.0 through 3.16.4, apply the patch manually by modifying pypdf/generic/ data structures.py.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-46250

GHSA-WJCC-CQ79-P63F

PYSEC-2026-1834

Affected Products

Pypdf

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46250.json · Exploit
• https://github.com/py-pdf/pypdf/pull/2264 · Patch
• https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d · Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46250 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjcc-cq79-p63f · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46250 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46250 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1834 · Vendor Advisory
• https://github.com/py-pdf/pypdf · Note
• https://twitter.com/VulmonFeeds/status/1719423139849904467 · Twitter Post
• https://github.com/advisories/GHSA-wjcc-cq79-p63f · Note
• https://t.me/cibsecurity/73260 · Telegram Post