CVE-2026-59936

What it actually does

Unterminated inline image in a PDF page content stream triggers an infinite loop in the inline image end marker detection logic during operations such as text extraction.

Why it matters to the business

Services that parse untrusted PDFs with pypdf can become unresponsive, halting document processing workflows and consuming excessive CPU resources.

How an attack unfolds

An attacker creates a PDF containing a page content stream with an inline image that lacks a proper termination marker. When the target application invokes pypdf to process the page (for example, extracting text), the parser enters an endless loop while searching for the end marker, resulting in denial of service.

How to fix it

Upgrade pypdf to version 6.14.1 or later.

How to confirm the fix worked

Verify the installed pypdf version is 6.14.1 or higher; test processing of sample PDFs containing unterminated inline images to confirm the loop no longer occurs.

Typical attack path

1. Craft a PDF with a page content stream containing an unterminated inline image
2. Deliver the PDF to an application that uses pypdf for page processing or text extraction
3. Trigger the vulnerable parsing code path
4. Induce an infinite loop that consumes CPU and blocks further processing

How to detect it

Review application and system logs for processes using pypdf that exhibit prolonged high CPU usage or apparent hangs during PDF handling; correlate with inbound untrusted PDF files.

What your security team should do

• Upgrade all instances of pypdf to 6.14.1 or later as the primary remediation
• Add input sanitization or sandboxing around PDF processing to limit impact of malformed files
• Monitor PDF-processing services for sustained high CPU usage that may indicate attempted exploitation