VDB
CVE-2026-113786
CVE-2026-113786
PUBLISHED
CVSS 2.3 LOW
Reported by GitHub_M · Published October 21, 2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.
Risk Scores
CVSS 4.0
2.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| py-pdf | pypdf | < 6.21.1 |
| py-pdf | pypdf | 0 |
| PyPI | pypdf | 0 |
| wolfi | open-webui | 0 |
| chainguard | open-webui | 0 |
Timeline
- Oct 21, 2026 CVE Published
- Oct 22, 2026 EPSS Score
- Oct 22, 2026 Coalition ESS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 27, 2026 CVE Updated
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/pull/4222 x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07 x_refsource_MISC
- https://github.com/py-pdf/pypdf/releases/tag/6.21.1 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-113786 advisory
- https://github.com/advisories/GHSA-5hx5-vpf9-5wcv advisory