p PatchFirst

CVE-2026-113786

CVE-2026-113786 · pypdf: Unvalidated JPEG image data loading

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

CVSS 2.3 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pypdf

    Versions
    • < 6.21.1: Affected

    No fix published

  • pypdf Debian:12

    Versions
    • 3.17.4-1
    • 3.4.1-1
    • 3.4.1-1+deb12u1
    • 4.0.0-1
    • 4.0.0-1~exp1
    • 4.0.1-1
    • 4.0.2-1
    • 4.1.0-1
    • 4.2.0-1
    • 4.3.1-1
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.21.1-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:13

    Versions
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.21.1-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:14

    Versions
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: < 6.21.1-1

    Update to 6.21.1-1

  • pypdf2 Debian:12

    Versions
    • 2.12.1-3
    • 2.12.1-3+deb12u1
    • 2.12.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf PyPI

    Versions
    • 1.0
    • 1.1
    • 1.10
    • 1.11
    • 1.12
    • 1.13
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.8
    • 1.9
    • 3.1.0
    • 3.10.0
    • 3.11.0
    • 3.11.1
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.14.0
    • 3.15.0
    • 3.15.1
    • 3.15.2
    • 3.15.3
    • 3.15.4
    • 3.15.5
    • 3.16.0
    • 3.16.1
    • 3.16.2
    • 3.16.3
    • 3.16.4
    • 3.17.0
    • 3.17.1
    • 3.17.2
    • 3.17.3
    • 3.17.4
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.4.0
    • 3.4.1
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.7.0
    • 3.7.1
    • 3.8.0
    • 3.8.1
    • 3.9.0
    • 3.9.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.5.0
    • 5.6.0
    • 5.6.1
    • 5.7.0
    • 5.8.0
    • 5.9.0
    • 6.0.0
    • 6.1.0
    • 6.1.1
    • 6.1.2
    • 6.1.3
    • 6.10.0
    • 6.10.1
    • 6.10.2
    • 6.11.0
    • 6.12.0
    • 6.12.1
    • 6.12.2
    • 6.13.0
    • 6.13.1
    • 6.13.2
    • 6.13.3
    • 6.14.0
    • 6.14.1
    • 6.14.2
    • 6.15.0
    • 6.16.0
    • 6.16.1
    • 6.16.2
    • 6.17.0
    • 6.18.0
    • 6.18.1
    • 6.19.0
    • 6.2.0
    • 6.20.0
    • 6.20.1
    • 6.21.0
    • 6.3.0
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.6.2
    • 6.7.0
    • 6.7.1
    • 6.7.2
    • 6.7.3
    • 6.7.4
    • 6.7.5
    • 6.8.0
    • 6.9.0
    • 6.9.1
    • 6.9.2
    Affected ranges
    • ECOSYSTEM: < 6.21.1

    Update to 6.21.1

  • pypdf2 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.23+git20141008-1
    • 1.25.1-1
    • 1.25.1-1ubuntu0.1~esm1
    • 1.25.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.26.0-2
    • 1.26.0-2ubuntu0.1~esm1
    • 1.26.0-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:20.04:LTS

    Versions
    • 1.26.0-2
    • 1.26.0-3ubuntu1
    • 1.26.0-3ubuntu1.20.04.1
    • 1.26.0-3ubuntu1.20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:22.04:LTS

    Versions
    • 1.26.0-4
    • 1.26.0-4ubuntu0.22.04.1
    • 1.26.0-4ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:24.04:LTS

    Versions
    • 3.4.1-1
    • 3.17.4-1
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:24.04:LTS

    Versions
    • 2.12.1-3
    • 2.12.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.10

    Versions
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.04:LTS

    Versions
    • 5.4.0-1
    • 6.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →