pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-jfx9-29x2-rv3j | pypdf can exhaust RAM via manipulated LZWDecode streams |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 22 Oct 2025 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3. | |
| Title | pypdf manipulated LZWDecode streams can exhaust RAM | |
| Weaknesses | CWE-409 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-22T21:36:56.788Z
Reserved: 2025-10-20T19:41:22.739Z
Link: CVE-2025-62708
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-22T22:15:35.880
Modified: 2025-10-22T22:15:35.880
Link: CVE-2025-62708
Redhat
No data.
OpenCVE Enrichment
No data.