Medium severity · published Apr 18, 2022
CVE-2022-24859
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
5.5
CVSS
1.3%
EPSS
No
On KEV
Description
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
9.0 · source: NVD
PY
Pypdf2 · Pypdf2 Project
before 1.27.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24859
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24859
Exploit
https://github.com/py-pdf/PyPDF2/issues/329
Patch
https://github.com/py-pdf/PyPDF2/pull/740
Release Notes
https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5
Exploit
https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79
Mailing List
https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
