CVE-2025-62707

moderate-risk

Published 2025-10-22

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Pypdf

Affected Vendors

Pypdf Project

References (4)

Patch https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8

Patch https://github.com/py-pdf/pypdf/pull/3501

Release Notes https://github.com/py-pdf/pypdf/releases/tag/6.1.3

Third Party Advisory https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal