CVE-2025-66019Disclosure

LOWCVSS 6.6 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patched in version 6.4.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-400CWE-409

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Yunus Aydın@aydinnyunuss91d
Disclosure
"CVE-2025-66019: LZW Decompression DoS Vulnerability in pypdf Library" is live in Paged Out! Issue #9. Parsing untrusted PDFs is inherently risky, but small structural flaws can easily escalate into critical availability impacts.
Post summary
A new DoS vulnerability (CVE-2025-66019) affecting the pypdf library’s LZW decompression has been disclosed, underscoring the risk of parsing untrusted PDFs.
02093455
1.2K followersView on X

Explore more

Back to dashboard