Listen to this Post
How the CVE Works
The vulnerability resides in the LZWDecode filter used by pypdf to decompress data streams within PDF files. The LZW algorithm builds a dictionary of previously encountered byte sequences. A maliciously crafted PDF can contain an LZW stream designed to generate an excessively large dictionary and output data without triggering the standard decompression bombs checks. This forces the decompression process to allocate massive amounts of memory to store the growing dictionary and decompressed output. By creating multiple such streams, an attacker can exhaust the system’s available RAM, leading to a Denial-of-Service condition for the application processing the PDF.
Platform: pypdf
Version: <6.4.0
Vulnerability: Memory Exhaustion
Severity: Moderate
date: 2025-11-23
Prediction: Patch available (2025-11-23)
What Undercode Say:
`$ pip show pypdf | grep Version`
`$ python -c “import pypdf; print(pypdf.__version__)”`
`$ pip install pypdf==6.4.0`
How Exploit:
Craft PDF with malicious LZW stream.
Protection from this CVE
Upgrade to pypdf 6.4.0.
Impact:
Denial-of-Service via RAM exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
