Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pypdf | pip | < 6.14.2 | 6.14.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is an infinite loop condition within the pypdf library when parsing malformed inline images that use either ASCII85 or ASCIIHex decoding. The root cause lies in the extract_inline__ascii_hex_decode and extract_inline__ascii85_decode functions located in pypdf/generic/_image_inline.py. These functions contain while True loops designed to read data until a specific end-of-image delimiter is found. However, the original code did not properly handle the scenario where the end of the data stream is reached before the delimiter. If the stream ended, the stream.read() call would return an empty bytestring, but the loop's exit condition would not be met, causing the process to hang. The patch fixes this by adding an explicit check on the result of stream.read(). If it returns no data, an exception is raised, ensuring the loop terminates and preventing the denial of service.
extract_inline__ascii_hex_decodepypdf/generic/_image_inline.py
extract_inline__ascii85_decodepypdf/generic/_image_inline.py