CVE-2022-24859

CVE-2022-24859 is a denial-of-service vulnerability affecting PyPDF2 versions prior to 1.27.5, including Debian distributions. An attacker can craft a malicious PDF that, when processed by PyPDF2 to retrieve its content stream, triggers an infinite loop due to improper handling of inline images, effectively freezing the application. Rated as Medium severity (CVSS 5.5), this vulnerability requires user interaction (UI:R) to open the malicious PDF and has a low attack complexity (AC:L). The primary impact is high availability loss (A:H), as it can render the application unresponsive. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.