Executive brief
pypdf is a popular Python library used for reading and manipulating PDF files. A vulnerability in how the library processes certain compressed images can allow an attacker to provide a specially crafted PDF that causes the application to hang or run extremely slowly. This could lead to a denial-of-service, preventing the application from processing other files or serving users.
Technical details
The vulnerability is classified as CWE-407 (Inefficient Algorithmic Complexity) within the `_decode_png_prediction` function of the pypdf library. It is triggered when the library processes a PDF stream that utilizes the `/FlateDecode` filter combined with a PNG predictor. An attacker can exploit this by providing a malicious PDF file that, when parsed, causes the CPU to spend an excessive amount of time on decoding, leading to a denial-of-service (DoS) condition. The issue was addressed in version 6.12.2 by optimizing the memory and speed of the PNG prediction decoding logic.
Affected products
- py-pdf pypdf < 6.12.2
Timeline
- 2026-05-26: patched: Fix released in version 6.12.2
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD