pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

🗓️ 23 Jul 2026 16:37:07Reported by GitHub Advisory DatabaseType

pypdf flaw causes infinite loops when parsing unterminated inline images with ASCII85 or ASCIIHex filters

Reporter	Title	Published	Views	Family All 45
ATTACKERKB	CVE-2026-59935	8 Jul 202619:34	–	attackerkb
Chainguard	CVE-2026-59935 vulnerabilities	29 Jul 202620:23	–	cgr
Circl	CVE-2026-59935	8 Jul 202622:07	–	circl
CVE	CVE-2026-59935	8 Jul 202619:34	–	cve
Cvelist	CVE-2026-59935 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)	8 Jul 202619:34	–	cvelist
Debian CVE	CVE-2026-59935	8 Jul 202619:34	–	debiancve
EUVD	EUVD-2026-42365	23 Jul 202616:37	–	euvd
NVD	CVE-2026-59935	8 Jul 202620:16	–	nvd
OSV	CGA-758R-J93J-96XQ	29 Jul 202616:11	–	osv
OSV	CLEANSTART-2026-EH47852 Security fixes for CVE-2026-34180, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, ghsa-537c-gmf6-5ccf, ghsa-jm82-fx9c-mx94 applied in versions: 1.85.1-r0, 1.89.5-r0, 1.90.2-r0	21 Jul 202607:54	–	osv

Vulners

Node

Source	Link
github	www.github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59935
github	www.github.com/py-pdf/pypdf/pull/3892
github	www.github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2
github	www.github.com/py-pdf/pypdf/releases/tag/6.14.2
github	www.github.com/advisories/GHSA-g867-7843-wf8q

23 Jul 2026 16:37Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

CVSS 48.7

EPSS0.00367

SSVC