VDB
CVE-2026-59936
CVE-2026-59936
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published July 8, 2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| py-pdf | pypdf | < 6.14.1 |
| wolfi | open-webui | 0, 0, 0 |
| chainguard | open-webui | 0 |
| chainguard | litellm | 0, 0, 0 |
| py-pdf | pypdf | < 6.14.1, < 6.14.1 |
Timeline
- Jul 8, 2026 CVE Published
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
- Jul 9, 2026 CVE Updated
- Jul 10, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/pull/3891 x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b x_refsource_MISC
- https://github.com/py-pdf/pypdf/releases/tag/6.14.1 x_refsource_MISC