CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline images
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
pypdf: Possible infinite loop for not terminated inline images
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
CVE-2026-59936- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-42366
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
EUVD-2026-42366- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5xf7-4p34-54qr
pypdf: Possible infinite loop for not terminated inline images
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
Patches
This has been fixed in pypdf==6.14.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3891.
- Record
GHSA-5xf7-4p34-54qr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-835
- Updated
- 2026-11-02
NVD
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
CVE-2026-59936- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
pypdf: Possible infinite loop for not terminated inline images
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
CVE-2026-59936- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-59936
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
DEBIAN-CVE-2026-59936- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Show 7 moreShow less
OSVGHSA-5xf7-4p34-54qr
pypdf: Possible infinite loop for not terminated inline images
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
Patches
This has been fixed in pypdf==6.14.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3891.
- Record
GHSA-5xf7-4p34-54qr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-835
- Updated
- 2026-11-02
OSVPYSEC-2026-3612
pypdf: Possible infinite loop for not terminated inline images
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
Patches
This has been fixed in pypdf==6.14.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3891.
- Record
PYSEC-2026-3612- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59936
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
- Record
UBUNTU-CVE-2026-59936- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1787029138 No score
TuxCare security update for pypdf (1 CVE)
TuxCare rebuilt pypdf to address 1 CVE. Fixed in 5.9.0.post13+tuxcare.
- Record
CLSA-2026-1787029138- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11238-1 No score
python313-pypdf-6.14.2-1.1 on GA media
These are all security issues fixed in the python313-pypdf-6.14.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11238-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21589-1 No score
Security update for python-PyPDF2
This update for python-PyPDF2 fixes the following issues:
Changes in python-PyPDF2:
- CVE-2026-59937: possible long runtimes for repeated malformed cross-reference entries (bsc#1271147)
- CVE-2026-59936: possible infinite loop for not terminated inline images (bsc#1271146)
- Record
openSUSE-SU-2026:21589-1- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-59936 No score
CVE-2026-59936 in pypdf - Patched by Root
Root has patched CVE-2026-59936 in the pypdf package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-59936- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pypdfPyPI |
before 6.14.1 | 6.14.1 |
pypdfTuxCare:PyPI |
5.9.0 up to 5.9.0.post13+tuxcare, plus listed versions 5.9.0.post1+tuxcare5.9.0.post10+tuxcare5.9.0.post11+tuxcare5.9.0.post12+tuxcare5.9.0.post2+tuxcare Show 7 moreShow less5.9.0.post3+tuxcare5.9.0.post4+tuxcare5.9.0.post5+tuxcare5.9.0.post6+tuxcare5.9.0.post7+tuxcare5.9.0.post8+tuxcare5.9.0.post9+tuxcare |
5.9.0.post13+tuxcare |
pypdfDebian:12 |
All versions, plus listed versions 3.17.4-13.4.1-13.4.1-1+deb12u14.0.0-14.0.0-1~exp1 Show 13 moreShow less4.0.1-14.0.2-14.1.0-14.2.0-14.3.1-15.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:13 |
All versions, plus listed versions 5.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:14 |
before 6.19.0-1, plus listed versions 5.4.0-16.9.0-16.9.2-16.9.2-2 |
6.19.0-1 |
pypdf2Debian:12 |
All versions, plus listed versions 2.12.1-32.12.1-3+deb12u12.12.1-4 |
None known |
pypdfPyPI |
before 6.14.1, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.21.31.41.51.61.71.81.93.1.03.10.03.11.03.11.13.12.03.12.13.12.23.13.03.14.03.15.03.15.13.15.23.15.33.15.43.15.53.16.03.16.13.16.23.16.33.16.43.17.03.17.13.17.23.17.33.17.43.2.03.2.13.3.03.4.03.4.13.5.03.5.13.5.23.6.03.7.03.7.1 |
6.14.1 |
pypdfRoot:PyPI |
before 6.11.0+aikido.2 | 6.11.0+aikido.26.13.3+aikido.16.12.1+aikido.36.12.0+aikido.26.12.0+aikido.36.11.0+aikido.36.12.1+aikido.46.12.0+aikido.46.11.0+aikido.46.13.2+aikido.36.13.2+aikido.46.13.3+aikido.26.12.0+aikido.56.14.0+aikido.16.6.0+aikido.146.10.2+aikido.46.12.2+aikido.46.10.1+aikido.96.6.0+aikido.156.10.1+aikido.106.11.0+aikido.56.12.0+aikido.66.10.2+aikido.56.12.1+aikido.56.12.2+aikido.5 |
rootio-pypdfRoot:PyPI |
before 6.11.0+root.io.2 | 6.11.0+root.io.2 |
pypdf2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.23+git20141008-11.25.1-11.25.1-1ubuntu0.1~esm11.25.1-1ubuntu0.1~esm2 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pypdf2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.26.0-21.26.0-2ubuntu0.1~esm11.26.0-2ubuntu0.1~esm2 |
None known |
pypdf2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.26.0-21.26.0-3ubuntu11.26.0-3ubuntu1.20.04.11.26.0-3ubuntu1.20.04.2 |
None known |
pypdf2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.26.0-41.26.0-4ubuntu0.22.04.11.26.0-4ubuntu0.22.04.2 |
None known |
pypdfUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.1-13.17.4-14.0.0-14.0.1-14.0.2-1 |
None known |
pypdf2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.12.1-32.12.1-4 |
None known |
pypdfUbuntu:25.10 |
All versions, plus listed versions 4.3.1-15.4.0-1 |
None known |
pypdfUbuntu:26.10 |
All versions, plus listed versions 6.9.2-16.9.2-2 |
None known |
pypdfUbuntu:26.04:LTS |
All versions, plus listed versions 5.4.0-16.9.2-1 |
None known |
python-pypdfopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 6.14.2-1.1 | 6.14.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59936 is a high vulnerability (CVSS 8.7) in Py-pdf Pypdf, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in pypdf 6.14.1.
References
github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr
nvd.nist.gov/vuln/detail/CVE-2026-59936
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2026-59936
pypi.org/project/pypdf
ubuntu.com/security/CVE-2026-59936
cve.org/CVERecord?id=CVE-2026-59936
suse.com/security/cve/CVE-2026-59935
bugzilla.suse.com/1271146
Left out here: 60 versions. The JSON record has them.