pypdf: Unvalidated JPEG image data loading

낮음 2.3CVE-2026-113786 · GHSA-5hx5-vpf9-5wcv · Published 21/10/2026 · updated 27/10/2026

요약

CVE-2026-113786은(는) pypdf에 영향을 주는 낮음 (CVSS 2.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.38%, 전체 취약점의 31.5%보다 높음.
조치: 6.21.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.1`	`6.21.1`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data).

Users which do not have the optional Pillow dependency installed in their environment are not affected.

Patches

This has been fixed in pypdf==6.21.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4222.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

References

py-pdf/pypdf security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-113786 · ADVISORY
py-pdf/pypdf#4222 · WEB
py-pdf/pypdf commit 512d8eb · WEB
py-pdf/pypdf · PACKAGE
py-pdf/pypdf release 6.21.1 · WEB

pypdf의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pypdf

PyPI

< 6.21.1

6.21.1