CVE-2025-62708

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Vendor	Product	Versions
py-pdf	pypdf	< 6.1.3

References

https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368daPatch
https://github.com/py-pdf/pypdf/pull/3502Patch
https://github.com/py-pdf/pypdf/releases/tag/6.1.3Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3jPatch, Vendor Advisory

Timeline

Published: Oct 22, 2025
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-627098.8ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to CVE-2025-62713.3A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the l CVE-2025-627105.9Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEn CVE-2025-627113.1Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm CVE-2025-627128.1JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-l CVE-2025-627137.2Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execu CVE-2025-627148.7Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.CVE-2025-627155.4ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerabil CVE-2025-627168.1Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter a CVE-2025-627179.1Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a cl CVE-2025-627189.9Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname norma CVE-2025-627194.3LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchControl