pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
At a glance
Severity
MEDIUM 4.8
EPSS
EPSS 0.23 % · percentile 13 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
GitHub_M
NVD status
Analyzed
Description
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
