CVE-2026-59935: py-pdf pypdf infinite loop in inline image parsing

Executive brief

A vulnerability in the pypdf library, a popular tool for manipulating PDF files, can allow an attacker to cause a denial-of-service condition. By providing a specially crafted PDF file, an attacker can trigger an infinite loop during file processing, such as when extracting text. This can lead to high CPU usage and cause applications or services using the library to become unresponsive.

Technical details

An infinite loop vulnerability (CWE-835) exists in pypdf due to improper handling of unterminated inline images. The issue is specifically triggered when parsing content streams that utilize ASCII85 or ASCIIHex filters. An attacker can exploit this by providing a crafted PDF; when the library attempts to parse the stream (e.g., during text extraction), it enters a loop with no exit condition. This results in a denial-of-service (DoS) by exhausting CPU resources. The vulnerability is fixed in version 6.14.2.

Affected products

• py-pdf pypdf < 6.14.2

Timeline

• 2026-06-23: disclosed
• 2026-07-08: advisory: NVD publication date
• 2026-07-23: patched: GitHub Advisory published/reviewed

References

• https://api.github.com/users/koltiradw
• https://github.com/koltiradw
• https://api.github.com/users/koltiradw/gists%7B/gist_id%7D
• https://api.github.com/users/koltiradw/repos
• https://avatars.githubusercontent.com/u/44571881?v=4
• https://api.github.com/users/koltiradw/events%7B/privacy%7D