N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62708

CVE-2025-62708: pypdf can exhaust RAM via manipulated LZWDecode streams

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3502.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62708

CVE-2025-62708:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.1.3	6.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a memory exhaustion issue (CWE-409: Improper Handling of Highly Compressed Data) in the pypdf library, specifically within its LZW decompression functionality. An attacker can craft a PDF containing a compressed data stream that, upon decompression, expands to an extremely large size, consuming all available memory and causing a denial of service.

The analysis of the provided patch commit e51d07807ffcdaf18077b9486dadb3dc05b368da reveals the exact location of the vulnerability and its fix.

pypdf/_codecs/_codecs.py: The core of the vulnerability lies in the LzwCodec.decode method. The patch introduces a mechanism to track the length of the output stream (output_length) and compares it against a max_output_length. If the limit is exceeded, a LimitReachedError is raised. Before this change, there was no such limit, allowing for uncontrolled memory allocation.
pypdf/filters.py: The LZWFlateDecode.decode method is the entry point for applying the LZW filter. It was modified to instantiate LzwCodec with a newly defined LZW_MAX_OUTPUT_LENGTH. This change ensures that the safety limit is applied whenever the LZW filter is used.

Therefore, during the exploitation of this vulnerability, a runtime profiler would show significant time and memory being spent in the LzwCodec.decode function, which is called by LZWFlateDecode.decode. These two functions are the primary indicators of the vulnerable code path being executed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62708: pypdf can exhaust RAM via manipulated LZWDecode streams

Impact

Patches

Workarounds

CVE-2025-62708:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-62708: pypdf can exhaust RAM via manipulated LZWDecode streams

Impact

Patches

Workarounds

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI