CVEvulnerability

CVE-2026-113786

2.3 LOW Published 2026-10-21 Modified 2026-10-27 Official page ↗
Status
Awaiting Analysis
Published
2026-10-21
Last modified
2026-10-27
Assigner
[email protected]
CVSS 4.0 ([email protected])
2.3 LOW — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-183, CWE-20

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

Related

Weakness · CWE (2)

  • CWE-183 Permissive List of Allowed Inputs weakness
  • CWE-20 Improper Input Validation weakness

References