CVE-2026-59935

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada pypdf project pypdf. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q patch · advisory vendor
• https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 patch
• https://github.com/py-pdf/pypdf/pull/3892 issue tracking · patch
• https://github.com/py-pdf/pypdf/releases/tag/6.14.2 product · release notes