CVE-2026-113786

pypdf: Unvalidated JPEG image data loading

State: Published
Severity: 2.3 Low
Published: Oct 21, 2026
Updated: Oct 27, 2026
Reserved: Oct 20, 2026

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-183 Permissive List of Allowed Inputs

Affected Products

Product	Versions
pypdfpy-pdf	< 6.21.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.