CVE-2025-62708: pypdf manipulated LZWDecode streams can exhaust RAM
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.
Patches This has been fixed in pypdf==6.1.3.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3502.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62708?
CVE-2025-62708 is considered a moderate severity vulnerability due to its potential for causing large memory usage.
How do I fix CVE-2025-62708?
To fix CVE-2025-62708, upgrade to pypdf version 6.1.3 or later.
What effect does CVE-2025-62708 have on PDF documents?
CVE-2025-62708 allows attackers to craft a malicious PDF that can lead to excessive memory consumption during content stream parsing.
Is CVE-2025-62708 present in earlier versions of pypdf?
Yes, CVE-2025-62708 affects all versions of pypdf prior to 6.1.3.
What type of attack can exploit CVE-2025-62708?
CVE-2025-62708 can be exploited through crafted PDF files that improperly leverage the LZWDecode filter.