{"api_version":"1","generated_at":"2026-05-13T13:33:34+00:00","cve":"CVE-2022-24859","urls":{"html":"https://cve.report/CVE-2022-24859","api":"https://cve.report/api/cve/CVE-2022-24859.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24859","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24859"},"summary":{"title":"CVE-2022-24859","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-04-18 19:15:00","updated_at":"2023-06-10 01:15:00"},"problem_types":["CWE-835"],"metrics":[],"references":[{"url":"https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5","name":"https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5","refsource":"MISC","tags":[],"title":"Release Version 1.27.5, 2022-04-15 · py-pdf/PyPDF2 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html","name":"[debian-lts-announce] 20230609 [SECURITY] [DLA 3451-1] pypdf2 security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3451-1] pypdf2 security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/py-pdf/PyPDF2/issues/329","name":"https://github.com/py-pdf/PyPDF2/issues/329","refsource":"MISC","tags":[],"title":"Manipulated inline images can force PyPDF2 into an infinite loop · Issue #329 · py-pdf/PyPDF2 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/py-pdf/PyPDF2/pull/740","name":"https://github.com/py-pdf/PyPDF2/pull/740","refsource":"MISC","tags":[],"title":"Improved performance and security for ContentStream_readInlineImage. by sekrause · Pull Request #740 · py-pdf/PyPDF2 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html","name":"[debian-lts-announce] 20220603 [SECURITY] [DLA 3039-1] pypdf2 security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3039-1] pypdf2 security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79","name":"https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79","refsource":"CONFIRM","tags":[],"title":"Manipulated inline images can cause Infinite Loop · Advisory · py-pdf/PyPDF2 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24859","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24859","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24859","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"24859","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pypdf2_project","cpe5":"pypdf2","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-24859","qid":"179353","title":"Debian Security Update for pypdf2 (DLA 3039-1)"},{"cve":"CVE-2022-24859","qid":"181838","title":"Debian Security Update for pypdf2 (DLA 3451-1)"},{"cve":"CVE-2022-24859","qid":"183839","title":"Debian Security Update for pypdf2 (CVE-2022-24859)"},{"cve":"CVE-2022-24859","qid":"199426","title":"Ubuntu Security Notification for PyPDF2 Vulnerability (USN-6176-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-24859","STATE":"PUBLIC","TITLE":"Manipulated inline images can cause Infinite Loop in PyPDF2"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"PyPDF2","version":{"version_data":[{"version_value":"< 1.27.5"}]}}]},"vendor_name":"py-pdf"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}]},"references":{"reference_data":[{"name":"https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79","refsource":"CONFIRM","url":"https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79"},{"name":"https://github.com/py-pdf/PyPDF2/issues/329","refsource":"MISC","url":"https://github.com/py-pdf/PyPDF2/issues/329"},{"name":"https://github.com/py-pdf/PyPDF2/pull/740","refsource":"MISC","url":"https://github.com/py-pdf/PyPDF2/pull/740"},{"name":"https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5","refsource":"MISC","url":"https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220603 [SECURITY] [DLA 3039-1] pypdf2 security update","url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20230609 [SECURITY] [DLA 3451-1] pypdf2 security update","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html"}]},"source":{"advisory":"GHSA-xcjx-m2pj-8g79","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-04-18 19:15:00","lastModifiedDate":"2023-06-10 01:15:00","problem_types":["CWE-835"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:pypdf2_project:pypdf2:*:*:*:*:*:*:*:*","versionEndExcluding":"1.27.5","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24859","Ordinal":"228173","Title":"CVE-2022-24859","CVE":"CVE-2022-24859","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24859","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}