CVE-2026-113793

Analyzed Analyzed - Analysis Complete

Remote Code Execution Risk in PyPDF Library

Publication date: 2026-10-21

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113793

EUVD

EUVD-2026-107334

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.20.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability in the PyPDF library (versions prior to 6.20.1) involves a flaw in handling cyclic PDF tree structures. When an object like an outline item is removed from a crafted cyclic tree, the process enters an infinite loop, blocking the current operation.

Detection Guidance

Detecting this vulnerability requires checking the version of the pypdf library in use. Run `pip show pypdf` to check the installed version. If the version is below 6.20.1, the system is vulnerable. Additionally, inspect PDF files processed by the library for cyclic tree structures, which may trigger infinite loops during operations like removing outline items.

Impact Analysis

An attacker could exploit this by providing a malicious PDF file that triggers an infinite loop when processed. This could lead to denial-of-service conditions, freezing applications or systems using affected PyPDF versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves an infinite loop in PDF processing due to cyclic tree structures, which could lead to denial-of-service conditions. Compliance impacts would only occur if such disruptions affected data processing or availability of personal health information, which is not specified in the provided context.

Mitigation Strategies

Upgrade the pypdf library to version 6.20.1 or later using `pip install --upgrade pypdf`. If immediate upgrade is not possible, apply the changes from pull request #4188 as a temporary workaround. Avoid processing untrusted PDF files until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-113793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...