CVE-2025-62707: pypdf affected by possible infinite loop when reading DCT inline images without EOF marker
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.
Patches This has been fixed in pypdf==6.1.3.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3501.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62707?
CVE-2025-62707 is considered a serious vulnerability as it can lead to an infinite loop when parsing specific PDF files.
How do I fix CVE-2025-62707?
To fix CVE-2025-62707, update the pypdf package to version 6.1.3 or higher.
What kind of attack does CVE-2025-62707 enable?
CVE-2025-62707 enables an attacker to craft a malicious PDF that triggers an infinite loop during content stream parsing.
Which versions of pypdf are affected by CVE-2025-62707?
Versions of pypdf prior to 6.1.3 are affected by CVE-2025-62707.
What component of the PDF is involved in CVE-2025-62707?
CVE-2025-62707 specifically involves the parsing of inline images using the DCTDecode filter within PDF files.