Loading story…
The Python PDF library pypdf patched a denial-of-service vulnerability tracked as CVE-2026-59935 that can cause affected applications to hang while parsing crafted PDF files. The flaw affects versions earlier than 6.14.2 and is triggered by non-terminated inline images using ASCII85 or ASCIIHex filters, allowing a malicious PDF to drive the parser into an infinite loop during operations such as page text extraction.
The fix was merged in pull request #3892 and shipped in pypdf 6.14.2, where parsing logic was changed to raise PdfReadError on unexpected end-of-stream conditions instead of looping indefinitely. The associated commit also added regression tests for malformed inline image data, addressing a CWE-835 weakness and reducing the risk of resource exhaustion in systems that automatically process untrusted PDFs.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-08, CVE-2026-59935 was added for a pypdf vulnerability affecting versions earlier than 6.14.2. The flaw allows a malicious PDF with a non-terminated inline image using ASCII85 or ASCIIHex filters to trigger an infinite loop during parsing, causing a denial-of-service condition.
On 2026-06-23, pypdf released version 6.14.2, which includes the security fix for infinite loops caused by incomplete ASCII85 and ASCIIHex inline images. The release notes classify the change as a security item and reference pull request #3892.
On 2026-06-23, the pypdf project merged pull request #3892 and the associated commit to prevent infinite loops when parsing incomplete ASCII85 and ASCIIHex inline images. The change makes the parser raise PdfReadError on unexpected end-of-stream conditions and adds regression tests for malformed inline image data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Python disclosed **CVE-2026-15308**, a high-severity denial-of-service flaw in `html.parser.HTMLParser` that can drive CPU exhaustion when applications incrementally parse untrusted HTML containing repeated unterminated markup declarations. The bug stems from quadratic-time behavior in `feed()`, where small repeated chunks force expensive rescanning and buffer concatenation across malformed tags, comments, doctypes, CDATA sections, processing instructions, and RAWTEXT elements. CPython maintainers shipped fixes and backports across supported branches including 3.10 through 3.15, with commits updating buffering logic to accumulate pending input more efficiently, defer reparsing until enough data arrives, adapt parsing thresholds based on parser progress, and flush buffered data on `close()`. The Python Software Foundation also updated the CVE record to clarify that affected versions are **earlier than 3.15.0**, not earlier than 3.16.0, while published metadata classifies the issue as **CWE-400** and notes no known exploitation at the time of disclosure.
Jul 10, 2026
A null pointer dereference vulnerability tracked as **`CVE-2019-9589`** affects **Xpdf 4.01** in the function **`PSOutputDev::setupResources()`** within `PSOutputDev.cc`. The flaw can be triggered when the **`pdftops`** binary processes a crafted PDF file, causing a segmentation fault and resulting in a denial-of-service condition. The issue was reported by the **ACE Team at Loginsoft**, which published debugger output, source-code context, and a proof-of-concept demonstrating the crash path. The disclosure notes indicate the vendor was notified before public release, and the affected software is distributed through the Xpdf project’s download channel. Organizations using Xpdf, especially workflows that automatically convert untrusted PDF files with `pdftops`, face a risk of service interruption and should verify whether vulnerable **4.01** deployments remain in use and apply an updated version or compensating controls where available.
Aug 15, 2026
Security researchers reported multiple previously unknown weaknesses across the PDF ecosystem that can be exploited through crafted documents. Novee Security’s research into *Foxit* and *Apryse* PDF platforms described **13 vulnerability categories** and **16 exploit paths**, including **critical XSS** and **OS command injection**, with “one-click” scenarios where simply opening a document could trigger compromise and potentially enable account takeover or backend command execution. Separately, a high-severity flaw in the widely used *jsPDF* library was disclosed as **CVE-2026-25755** (CVSS **8.8**), enabling **PDF object injection** via improper sanitization in the `addJS` method. By breaking out of the `/JS (...)` string (e.g., injecting `) >> /Action ...`), an attacker can inject arbitrary PDF structures and actions such as `/OpenAction`, potentially triggering behavior even when JavaScript is disabled in the viewer and enabling document manipulation (e.g., altering `/Annots` or `/Signatures`) across different PDF viewers, including lightweight mobile/embedded parsers.
Jun 29, 2026