N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54869

CVE-2025-54869: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Impact

This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability.

Patches

Fixed as of version 2.6.4

Workarounds

No.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54869

CVE-2025-54869:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
setasign/fpdi	composer	< 2.6.4	2.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the FPDI PDF parser's handling of recursive data structures within a PDF file. Specifically, the setasign/fpdi library did not properly check for circular references in PDF objects, such as indirect object references and page dictionaries. An attacker could craft a small PDF file with such circular references, causing the parsing engine to enter an infinite loop. This infinite recursion would continuously consume memory, eventually leading to a memory exhaustion error (OOM) and crashing the application, resulting in a Denial of Service (DoS).

The patch addresses this issue by introducing checks to detect and prevent these infinite recursions. In PdfType::resolve, a list of ensured objects is now passed along during recursion to detect if an object is being resolved again in the same chain. In PdfReader::getPage and PdfReader::readPages, a list of already read page kids is maintained to detect and prevent recursive page dictionary processing. The identified vulnerable functions are the entry points where this uncontrolled recursion was triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-54869: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Impact

Patches

Workarounds

CVE-2025-54869:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2025-54869: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Impact

Patches

Workarounds

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI