TI-2025-34603 Aliases CVE-2025-54869 GHSA-jxhh-4648-vpp3

FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF Parser

LOW 27CWE-770Published 2025-08-05 · Updated 2025-08-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00349 28th percentileScored 2026-11-07

Fix Fixed FPDI (Setasign): 2.6.3setasign/fpdi (Packagist): 2.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Setasign	FPDI	before 2.6.3	2.6.3	Patch available	CNA
—	setasign/fpdi (Packagist)	before 2.6.4	2.6.4	Patch available	GHSA-jxhh-4648-vpp3

FPDI VendorSetasign Affected before 2.6.3 Fixed in 2.6.3 Patch available CNA
setasign/fpdi (Packagist) Vendor— Affected before 2.6.4 Fixed in 2.6.4 Patch available GHSA-jxhh-4648-vpp3

Remediation

Fix · CNA FPDI (Setasign) Fixed in 2.6.3
Fix · GHSA-jxhh-4648-vpp3 setasign/fpdi (Packagist) Fixed in 2.6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-54869
2026-10-03 Alias added: GHSA-jxhh-4648-vpp3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-54869

Other 3

TI-2026-33537 FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service CVSS 4.0MEDIUM 6.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences