CVE-2023-36464
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The pypdf library, an open-source pure-Python library, has a vulnerability that can lead to an infinite loop when processing a malicious PDF file. This issue occurs in versions where the `__parse_content_stream` method is executed.
Risk Assessment
An attacker may exploit this vulnerability to freeze the application processing the PDF, potentially leading to service unavailability. Organizations should be aware of the risks associated with processing unknown PDF files.
Recommendation
It is recommended to upgrade the pypdf library to the latest version to eliminate this vulnerability. Users unable to upgrade should modify the code to mitigate the risk.
Original NVD description (English source)
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.