PyPI/pypdf CVE-2025-62708: high 7.5, EPSS 0.44%

pypdf can exhaust RAM via manipulated LZWDecode streams

Action: Upgrade pypdf to 6.1.3 or later.

pip install pypdf==6.1.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1831
• nvd: CVE-2025-62708
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j
• https://github.com/py-pdf/pypdf/pull/3502
• https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.1.3
• https://pypi.org/project/pypdf
• https://github.com/advisories/GHSA-jfx9-29x2-rv3j

CVE-2025-62708 · published 2026-07-07T16:03:08.153838Z · modified 2026-07-07T17:46:59.105637375Z · JSON