CVE-2026-113786

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Image Parser Selection in pypdf

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113786

EUVD

EUVD-2026-107286

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	< 6.21.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-183	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability in the pypdf library (versions prior to 6.21.1) involves improper handling of /DCTDecode image data in PDFs. The _xobj_to_image function processes such data without restricting the image format, allowing Pillow to use any available plugin. This could lead to non-JPEG data being misinterpreted and executed via plugins like EpsImagePlugin, which runs Ghostscript on embedded PostScript files.

Detection Guidance

Check if your system uses pypdf versions prior to 6.21.1 by running: pip show pypdf. If installed, verify the version. If vulnerable, update to 6.21.1 or later. Environments without Pillow are not affected.

Impact Analysis

An attacker could craft a malicious PDF file that triggers arbitrary code execution when the image data is loaded. This requires the optional Pillow dependency to be installed. Users without Pillow are not affected. The impact includes potential system compromise if Ghostscript is installed and processes malicious PostScript data.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves improper input validation in PDF processing, which could allow arbitrary code execution via malicious embedded files. Compliance impact would only occur if such code execution led to unauthorized data access or processing, which is not specified in the provided context.

Mitigation Strategies

Immediately update pypdf to version 6.21.1 or later using pip install --upgrade pypdf. If upgrading is not possible, apply changes from PR #4222 as a workaround. Ensure Pillow is installed to enforce format restrictions.

Hi! I’m here to help you understand CVE-2026-113786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...