CVE-2026-59935

What it actually does

Malformed PDF page content streams with unterminated inline images using ASCII85 or ASCIIHex filters trigger an infinite loop in the parser, consuming CPU and blocking further processing.

Why it matters to the business

Services that parse PDFs with this library can become unresponsive, delaying document workflows and requiring manual restarts.

How an attack unfolds

An attacker creates a PDF containing a page content stream with an inline image that lacks the expected termination sequence for ASCII85 or ASCIIHex, then supplies the file to any application using the vulnerable parser for text extraction or similar operations, causing the process to hang indefinitely.

How to fix it

Upgrade pypdf to version 6.14.2 or later; if immediate upgrade is not possible, implement input validation or sandboxing around PDF parsing operations.

How to confirm the fix worked

Confirm installed version is at least 6.14.2 via package metadata, then attempt to parse a test PDF containing the previously triggering unterminated inline image and verify the operation completes without hanging.

Typical attack path

1. Craft a minimal PDF with an unterminated inline image using ASCII85 or ASCIIHex filter in the page content stream
2. Deliver the file to a target application that invokes pypdf parsing functions such as text extraction
3. Trigger the parser on the malicious content to enter the infinite loop
4. Observe sustained high CPU usage and blocked application threads

How to detect it

Review application logs and system process monitors for PDF parsing tasks that consume 100% CPU for extended periods without completing; correlate with file ingestion timestamps of PDF documents.

What your security team should do

• Prioritize upgrade to pypdf 6.14.2 across all environments handling untrusted PDFs
• Add runtime resource limits or timeouts around PDF parsing calls
• Monitor for sustained high-CPU PDF processing tasks as a temporary detection measure