GHSA-m449-cwjh-6pw7 | Mondoo Vulnerability Intelligence

GHSA-m449-cwjh-6pw7

MEDIUM6.6

pypdf's LZWDecode streams be manipulated to exhaust RAM

Published Nov 24, 2025

Modified 9 months ago

Fix available

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter.

This is a follow up to GHSA-jfx9-29x2-rv3j to align the default limit with the one for zlib.

Patches

This has been fixed in pypdf==6.4.0.

Workarounds

If users cannot upgrade yet, use the line below to overwrite the default in their code:

pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000

Affected Packages

pypdf

PyPI

Fixed in:

6.4.0

References

WEB

https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos

ADVISORY

https://github.com/advisories/GHSA-m449-cwjh-6pw7

PACKAGE

https://github.com/py-pdf/pypdf

WEB

https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2

WEB

https://github.com/py-pdf/pypdf/releases/tag/6.4.0

WEB

https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j

WEB

https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2025-66019

Aliases

CVE-2025-66019

CVSS Analysis

CVSS v4.0

6.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

NoneVI:N

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.6/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CVE-2025-66019

Ecosystems

PyPI

Timeline

PublishedNov 24, 2025

ModifiedJan 21, 2026