CVE-2023-46250

    Dashboard / Vulnerabilities / CVE-2023-46250

    CVE-2023-46250

    Published: 31 Oct 2023Last Modified: 28 Oct 2026

    Summary: pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

    Details: pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46250.json, https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f, https://nvd.nist.gov/vuln/detail/CVE-2023-46250, https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d, https://github.com/py-pdf/pypdf/pull/2264

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 050bca679ca1b7988977a9df784e874ff33d1b9e
    Fixed -5a2dd757e14229899e3f48e9891e6d9a63c7963b

    Affected versions

    3.16.4
    3.16.3
    3.16.2
    3.16.1
    3.16.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46250 | CVE-DB