CVE-2025-54869 - FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF Parser

Back Back to CVE browser

MEDIUM

FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF Parser

Published Aug 5, 2025

6.0

MEDIUM

CVSS 4.0

EPSS 0.31%

Description

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.

Affected products

Vendor Setasign Product FPDI Default
unknown
Affected
- < 2.6.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Setasign	FPDI	unknown	Affected < 2.6.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23667
Advisory
https://github.com/Setasign/FPDI/commit/ba671ba9221cffd32c2dda87316c19f522a1c5f0
x_refsource_MISC
https://github.com/Setasign/FPDI/security/advisories/GHSA-jxhh-4648-vpp3
x_refsource_CONFIRM
https://github.com/advisories/GHSA-jxhh-4648-vpp3
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-54869

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23667		Advisory
https://github.com/Setasign/FPDI/commit/ba671ba9221cffd32c2dda87316c19f522a1c5f0		x_refsource_MISC
https://github.com/Setasign/FPDI/security/advisories/GHSA-jxhh-4648-vpp3		x_refsource_CONFIRM
https://github.com/advisories/GHSA-jxhh-4648-vpp3		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-54869