CVE-2026-113786: falha de baixa gravidade em py-pdf pypdf
pypdf: Unvalidated JPEG image data loading
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.4%
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
py-pdf · pypdfCVEs relacionadas — py-pdf pypdf
No mesmo produto, das mais perigosas para as menos.
CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-59936HIGHpypdf: Possible infinite loop for not terminated inline imagesEPSS 0.6%CVE-2026-59935HIGHpypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)EPSS 0.6%CVE-2026-59937MEDIUMpypdf: Possible long runtimes for repeated malformed cross-reference entriesEPSS 0.6%CVE-2023-36807MEDIUMInfinite Loop when reading malformed objects in pypdfEPSS 0.6%CVE-2026-82398MEDIUMpypdf: Inefficient handling of non-whitespace inputs in read_until_whitespaceEPSS 0.5%