CVE-2026-113786: pypdf < 6.21.1

Affected technology

pypdf · < 6.21.1
py-pdf

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

An attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Vendor/CNA’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality and integrity impact as none; availability impact as low.