CVE-2026-59935: pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.
Patches
This has been fixed in pypdf==6.14.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3892.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.14.2 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.14.2 - Compensating control
If you cannot upgrade yet, apply the workaround changes from PR [#3892] to fix the infinite loop in the ASCII85 and ASCIIHex filters for not terminated inline images during content stream parsing (e.g., when extracting page text).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59935?
CVE-2026-59935 has a high severity rating of 8.7 according to the CVSS.
How do I fix CVE-2026-59935?
To fix CVE-2026-59935, you need to update to pypdf version 6.14.2 or later.
What kind of vulnerability is CVE-2026-59935?
CVE-2026-59935 is a vulnerability that can lead to an infinite loop in the pypdf library when parsing improperly terminated inline images.
Which software is affected by CVE-2026-59935?
CVE-2026-59935 affects the pypdf library prior to version 6.14.2.
What is the risk associated with CVE-2026-59935?
The risk associated with CVE-2026-59935 is classified as a 47, indicating significant potential impact.