CVE-2025-62708: 
Python vulnerability analysis and mitigation

CVE-2025-62708 affects pypdf, a free and open-source pure-python PDF library. The vulnerability was discovered and disclosed on October 22, 2025, affecting versions prior to 6.1.3. The issue allows attackers to craft malicious PDF files that can lead to excessive memory consumption when parsing content streams using the LZWDecode filter (GitHub Advisory, NVD).

The vulnerability is classified as CWE-409 (Improper Handling of Highly Compressed Data/Data Amplification). It received a CVSS v4.0 score of 6.6 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U. The issue specifically occurs during the parsing of content streams that use the LZWDecode filter, where maliciously crafted PDF files can cause the library to consume excessive amounts of RAM (Red Hat).

When exploited, this vulnerability can lead to large memory usage on systems processing PDF files with the affected library. This could potentially result in denial of service conditions due to resource exhaustion (GitHub Advisory).

The vulnerability has been fixed in pypdf version 6.1.3. Users are advised to upgrade to this version or later. For those unable to upgrade immediately, the changes from PR #3502 can be applied as a workaround (GitHub Advisory, GitHub Release).