PT-2026-56546 · Py Pdf · Pypdf

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59935

Mitre

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-59935

Affected Products

Pypdf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59935 · Security Note
• https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 · Note
• https://github.com/py-pdf/pypdf/pull/3892 · Note
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q · Note
• https://github.com/py-pdf/pypdf/releases/tag/6.14.2 · Note