CVE-2025-62707

What it actually does

This vulnerability is a denial-of-service flaw in pypdf's parsing of PDF page content streams containing inline images that use the DCTDecode filter. A specially crafted PDF can cause the parser to enter an infinite loop while processing the content stream, consuming CPU and preventing the parsing operation from completing. The impact is availability-focused: it does not inherently provide code execution, data disclosure, or privilege escalation, but it can hang worker processes, document-processing jobs, API requests, or batch pipelines that rely on affected pypdf code.

Why it matters to the business

Applications and services that ingest untrusted PDFs may become slow, unavailable, or unable to complete document-processing tasks if a malicious PDF is submitted. This can disrupt upload workflows, back-office processing, e-discovery, invoicing, document conversion, indexing, or any automated pipeline using pypdf. The EPSS score is low and there is no known KEV listing or ransomware association, so broad exploitation pressure appears limited, but exposure remains relevant for internet-facing or high-volume PDF ingestion services because exploitation requires only a crafted file to be processed.

How an attack unfolds

An attacker creates a malformed PDF whose page content stream includes an inline image using the DCTDecode filter in a structure that triggers the vulnerable parser behavior. The attacker then delivers the PDF to a system that automatically parses uploaded or received PDFs using an affected pypdf build. When the application attempts to inspect, split, merge, extract text from, transform, validate, or otherwise parse the page content stream, pypdf can enter an infinite loop. The affected process may consume CPU indefinitely or remain stuck until externally timed out or killed. In services without strict execution timeouts, worker isolation, or queue safeguards, repeated submissions can exhaust worker capacity and cause a denial of service for legitimate users.

How to fix it

Upgrade pypdf to a version or build that includes the upstream fix. For source-based deployments using py-pdf/pypdf from Git, ensure the codebase includes commit 4a613f3fbe7af8ef65bbae740ceabe35310db4ee or a later commit containing the fix. Remove or rebuild pinned vulnerable dependencies in application images, virtual environments, serverless packages, and worker containers. Where immediate upgrade is not possible, reduce risk by applying strict parsing timeouts, CPU and memory limits, queue retry limits, worker process isolation, maximum file-size and page-count limits, and rejection or sandboxing of untrusted PDFs before pypdf processing. Avoid processing externally supplied PDFs in privileged or long-lived processes without watchdog enforcement.

How to confirm the fix worked

Confirm dependency inventory shows pypdf is updated to a fixed build that includes commit 4a613f3fbe7af8ef65bbae740ceabe35310db4ee or later. Validate all deployed artifacts, including containers, build caches, virtual environments, and serverless bundles, because Python dependency updates can be missed when vendored or pinned. Run a controlled regression test using a representative malicious or malformed PDF sample in a non-production environment and verify parsing terminates safely with an error or bounded timeout rather than hanging. Confirm worker supervisors enforce timeouts and automatically terminate stuck PDF-processing tasks. Review software composition analysis, lockfiles, and runtime package metadata to ensure no affected pypdf copy remains in active use.

Typical attack path

1. Identify an application, API, queue, or batch process that accepts PDF files and processes them with pypdf.
2. Craft or obtain a PDF containing a page content stream with an inline image using the DCTDecode filter that triggers the infinite-loop condition.
3. Submit the PDF through an upload form, email ingestion path, API endpoint, file share, or document-processing workflow.
4. Wait for the backend service to parse the page content stream with the vulnerable pypdf code path.
5. Cause the parsing worker or request handler to hang or consume CPU until killed, timed out, or restarted.
6. Repeat submissions, if necessary, to exhaust worker pools, processing queues, or service capacity.

How to detect it

Look for evidence of availability disruption around PDF ingestion and parsing rather than classic compromise artifacts. Relevant sources include application logs from upload and document-processing services, worker queue logs, task supervisor logs, container or process monitoring, API gateway logs, web server logs, EDR process telemetry, and infrastructure metrics for CPU saturation or long-running Python processes. Investigate repeated requests or jobs involving PDF uploads that time out, never complete, trigger worker restarts, or coincide with sustained CPU usage. In application exceptions and debug logs, search for pypdf parsing activity involving page content streams, inline images, DCTDecode filters, or jobs stuck during PDF read/extract/merge operations. Since the flaw causes an infinite loop, there may be no clean exception; absence of an error paired with hung Python workers is meaningful. Preserve suspicious submitted PDF files for offline analysis in a sandbox and inspect them for inline image markers and DCTDecode usage in page content streams. No named threat actors or active exploitation campaigns are currently associated with this issue based on the supplied data.

• /DCTDecode
• DCTDecode
• BI
• ID
• EI
• pypdf
• PdfReader
• ContentStream
• inline image
• Timeout while processing PDF
• PDF processing timed out
• worker timeout
• task exceeded time limit
• CPU time limit exceeded
• SIGKILL
• SIGTERM
• killed worker
• stuck processing PDF
• application/pdf

What your security team should do

• Prioritize remediation for internet-facing upload services, email/document ingestion systems, and automated PDF-processing queues that parse untrusted files with pypdf.
• Upgrade to a fixed pypdf build containing commit 4a613f3fbe7af8ef65bbae740ceabe35310db4ee or later, and rebuild all affected application packages and containers.
• Add or verify watchdog timeouts, worker recycling, CPU limits, and queue back-pressure controls around PDF parsing tasks.
• Search application and infrastructure telemetry for repeated PDF-processing hangs, long-running workers, elevated CPU, request timeouts, and queue buildup associated with PDF uploads.
• Apply file validation controls for untrusted PDFs, including size limits, page-count limits, content-type verification, and sandboxed pre-processing where appropriate.
• Create regression tests for malformed PDFs so future dependency upgrades or parser changes do not reintroduce unbounded parsing behavior.
• Because current public exploitation indicators are limited and the issue is not in CISA KEV, treat this as a moderate-priority availability risk unless the affected service is mission-critical or exposed to anonymous file uploads.