Live › vulnerability › CVE-2026-113786
Go to dashboardpypdf does not validate JPEG (/DCTDecode) image data before handing it to image parsers, so a crafted PDF can cause arbitrary image parsers to be invoked. The advisory describes this as only reachable when the optional Pillow dependency is installed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.1 | 6.21.1 |
pip show pypdf and pip show pillow affected if pypdf is below 6.21.1 and Pillow is installed.
6.21.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data).
Users which do not have the optional Pillow dependency installed in their environment are not affected.
This has been fixed in pypdf==6.21.1.
If you cannot upgrade yet, consider applying the changes from PR #4222.
This page as .md · .json · in your agent: get_signal("CVE-2026-113786")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.