CVE-2025-66019CWE-400CWE-409denial-of-service

CVE-2025-66019

published November 26, 2025

CVSS
6.6
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patched in version 6.4.0.

The record
Technical detail
CVSS
6.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2025-11-26T05:15Z
References (4)
https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2 · [email protected]https://github.com/py-pdf/pypdf/releases/tag/6.4.0 · [email protected]https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7 · [email protected]https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 NOV 23:38Z
    pypdf manipulated LZWDecode streams can exhaust RAM
    cvelistv5