CVE-2026-59935 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using the pypdf library should assess exposure and prioritize upgrading to version 6.14.2 or later. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where

Why it matters

CVE-2026-59935 is a high-severity vulnerability in the pypdf library that can cause an infinite loop during parsing of malicious PDF files, potentially leading to denial-of-service attacks. Defenders should prioritize upgrading to version 6.14.2 or later.

• Potential denial-of-service attacks
• Increased risk of system crashes or freezes
• Need for urgent patching or mitigation
• Potential for exploitation in malicious PDF files

Technical summary

The pypdf library is vulnerable to an infinite loop attack when parsing malicious PDF files. An attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing the parser to enter an infinite loop. This can potentially lead to denial-of-service attacks, and defenders should prioritize upgrading to version 6.14.2 or later. The vulnerability has a high CVSS score of 8.7, indicating a high severity level. Defenders should assess exposure and prioritize upgrading to version 6.14.2 or later.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.14.2 or later to prevent potential denial-of-service attacks.

Recommended defensive actions

• Upgrade to pypdf version 6.14.2 or later
• Review and update affected systems and applications
• Monitor for potential denial-of-service attacks
• Perform vulnerability scanning and risk assessment
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 8.7 and the fixed version 6.14.2. The vulnerability is caused by an attacker crafting a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing. Defenders should verify affected systems and applications, and prioritize upgrading to version 6.14.2 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.