CVE-2026-59935
highpypdf is a free and open-source pure-python PDF library.
Vendor / product: Py-pdf — pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-08 20:16
Modified: 2026-11-02 16:06
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-11-03 07:34 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
py-pdf / pypdf <6.14.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/3892
Patch / mitigation: https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q
References
- https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 security-advisories@github.com
- https://github.com/py-pdf/pypdf/pull/3892 security-advisories@github.com
- https://github.com/py-pdf/pypdf/releases/tag/6.14.2 security-advisories@github.com
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:34 UTC · record ↗