{"id":"CVE-2026-113786","aliases":["CLSA-2026-1793019428","DEBIAN-CVE-2026-113786","EUVD-2026-107286","GHSA-5hx5-vpf9-5wcv","UBUNTU-CVE-2026-113786","openSUSE-SU-2026:12306-1","openSUSE-SU-2026:22188-1"],"status":"published","title":"pypdf: Unvalidated JPEG image data loading","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00405,"percentile":0.35211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-183","CWE-20"],"published":"2026-10-21T14:38:39Z","modified":"2026-11-01T17:27:16Z","fixes":[{"ecosystem":"PyPI","package":"pypdf","fixed_in":["6.21.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pypdf","fixed_in":["6.21.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.9.0.post21+tuxcare"}]}],"versions":["5.9.0","5.9.0.post1+tuxcare","5.9.0.post10+tuxcare","5.9.0.post11+tuxcare","5.9.0.post12+tuxcare","5.9.0.post13+tuxcare","5.9.0.post14+tuxcare","5.9.0.post15+tuxcare","5.9.0.post16+tuxcare","5.9.0.post17+tuxcare","5.9.0.post18+tuxcare","5.9.0.post19+tuxcare","5.9.0.post2+tuxcare","5.9.0.post20+tuxcare","5.9.0.post3+tuxcare","5.9.0.post4+tuxcare","5.9.0.post5+tuxcare","5.9.0.post6+tuxcare","5.9.0.post7+tuxcare","5.9.0.post8+tuxcare","5.9.0.post9+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-1","3.4.1-1","3.4.1-1+deb12u1","4.0.0-1","4.0.0-1~exp1","4.0.1-1","4.0.2-1","4.1.0-1","4.2.0-1","4.3.1-1","5.4.0-1","6.19.0-1","6.21.0-1","6.21.1-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.19.0-1","6.21.0-1","6.21.1-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.1-1"}]}],"versions":["5.4.0-1","6.19.0-1","6.21.0-1","6.9.0-1","6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-3","2.12.1-3+deb12u1","2.12.1-4"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.1"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.16.0","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","5.0.0","5.0.1","5.1.0","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.6.1","5.7.0","5.8.0","5.9.0","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.10.0","6.10.1","6.10.2","6.11.0","6.12.0","6.12.1","6.12.2","6.13.0","6.13.1","6.13.2","6.13.3","6.14.0","6.14.1","6.14.2","6.15.0","6.16.0","6.16.1","6.16.2","6.17.0","6.18.0","6.18.1","6.19.0","6.2.0","6.20.0","6.20.1","6.21.0","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.6.0","6.6.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","6.7.5","6.8.0","6.9.0","6.9.1","6.9.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23+git20141008-1","1.25.1-1","1.25.1-1ubuntu0.1~esm1","1.25.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-2","1.26.0-2ubuntu0.1~esm1","1.26.0-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1","1.26.0-3ubuntu1.20.04.1","1.26.0-3ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-4","1.26.0-4ubuntu0.22.04.1","1.26.0-4ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1-1","3.17.4-1","4.0.0-1","4.0.1-1","4.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-3","2.12.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.9.2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.2-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.0-bp160.2.1"}]}],"bundled":8}],"products":[{"vendor":"py-pdf","product":"pypdf"}],"references":[{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/py-pdf/pypdf/pull/4222","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113786","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5hx5-vpf9-5wcv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113786.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-113786","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-113786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113786","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113795","tags":["web"]},{"url":"https://bugzilla.suse.com/1286632","tags":["report"]},{"url":"https://bugzilla.suse.com/1286633","tags":["report"]},{"url":"https://bugzilla.suse.com/1286634","tags":["report"]},{"url":"https://bugzilla.suse.com/1286635","tags":["report"]},{"url":"https://bugzilla.suse.com/1286636","tags":["report"]},{"url":"https://bugzilla.suse.com/1286637","tags":["report"]},{"url":"https://bugzilla.suse.com/1286638","tags":["report"]},{"url":"https://bugzilla.suse.com/1286639","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113794","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-113786","title":"pypdf: Unvalidated JPEG image data loading","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T14:38:39.617Z","modified":"2026-10-27T22:18:57.01Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-20","CWE-183"],"updated_at":"2026-11-02T13:44:29.519518Z"}],"euvd":[{"id":"EUVD-2026-107286","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T14:38:39Z","modified":"2026-10-27T22:18:57Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:59:22.052945Z"}],"ghsa":[{"id":"GHSA-5hx5-vpf9-5wcv","title":"pypdf: Unvalidated JPEG image data loading","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).\n\nUsers which do not have the optional *Pillow* dependency installed in their environment are not affected.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).","status":"published","published":"2026-10-21T19:58:10Z","modified":"2026-10-21T19:58:11Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-20","CWE-183"],"updated_at":"2026-11-02T14:41:34.690842Z"}],"nvd":[{"id":"CVE-2026-113786","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T15:17:16.703Z","modified":"2026-10-27T23:16:57.327Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-20","CWE-183"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-113786","title":"pypdf: Unvalidated JPEG image data loading","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T14:38:39.617Z","modified":"2026-11-01T17:27:16.618976911Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-183","CWE-20"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"DEBIAN-CVE-2026-113786","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T15:17:16.703Z","modified":"2026-10-28T09:47:25.55268201Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-5hx5-vpf9-5wcv","title":"pypdf: Unvalidated JPEG image data loading","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).\n\nUsers which do not have the optional *Pillow* dependency installed in their environment are not affected.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).","status":"published","published":"2026-10-21T19:58:10Z","modified":"2026-10-21T20:15:04.178781594Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-183","CWE-20"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2026-113786","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.","status":"published","published":"2026-10-21T15:17:00Z","modified":"2026-10-28T20:17:44.830328059Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"CLSA-2026-1793019428","title":"TuxCare security update for pypdf (5 CVEs)","description":"TuxCare rebuilt pypdf to address 5 CVEs. Fixed in 5.9.0.post21+tuxcare.","status":"published","published":"2026-10-26T12:57:08Z","modified":"2026-10-27T01:45:04.474985127Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12306-1","title":"python313-pypdf-6.21.2-1.1 on GA media","description":"These are all security issues fixed in the python313-pypdf-6.21.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:15.843625742Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22188-1","title":"Security update for python-pypdf","description":"This update for python-pypdf fixes the following issues:\n\nChanges in python-pypdf:\n\n- CVE-2026-113786: PDF containing image data labeled with the\n  `/DCTDecode` filter causes Pillow to select and invoke an\n  unintended image parser when the image is loaded (bsc#1286632)\n- CVE-2026-113789: crafted PDF causes large memory usage or long\n  runtimes when an application retrieves the document's form fields\n  (bsc#1286633)\n- CVE-2026-113790: PDF containing arrays or dictionaries with many\n  elements causes parsing to consume large amounts of memory\n  (bsc#1286634)\n- CVE-2026-113791: PDF containing a content stream with many small\n  operations causes parsing to consume large amounts of memory\n  (bsc#1286635)\n- CVE-2026-113792: calling `PdfWriter.find_outline_item` on a\n  crafted PDF with a cyclic outline hierarchy can enter an infinite\n  loop and block the current process (bsc#1286636)\n- CVE-2026-113793: removing an object from a crafted cyclic PDF\n  tree can enter an infinite loop and block the current process\n  (bsc#1286637)\n- CVE-2026-113794: incomplete PDF that ends inside a standard\n  cross-reference table causes pypdf to mishandle the unexpected\n  end of file and enter an infinite loop (bsc#1286638)\n- CVE-2026-113795: accessing a crafted PDF stream with a large\n  number of filters or multiple filters that pass around large\n  amounts of data can cause large memory consumption (bsc#1286639)\n","status":"published","published":"2026-10-26T15:02:57Z","modified":"2026-11-01T17:23:29.513373666Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}