CVE-2026-113786 in pypdf
Summary
by MITRE • 10/21/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in pypdf, a widely used open-source Python library for PDF manipulation, represents a significant risk to applications that process untrusted or externally sourced PDF documents. The core of this issue lies in the interaction between pypdf and its optional dependency, Pillow, which is responsible for handling image data embedded within PDF files. Specifically, when pypdf encounters an image stream labeled with the /DCTDecode filter—a standard JPEG compression method—it delegates the decoding task to Pillow. However, prior to version 6.21.1, a flaw in this delegation process allows an attacker to craft a maliciously constructed PDF that tricks Pillow into selecting and invoking an unintended or incorrect image parser. This misdirection occurs because pypdf may not sufficiently validate or constrain the parameters passed to the underlying imaging library, leading to a mismatch between the expected decoding routine and the one actually executed by Pillow.
From a technical perspective, this flaw constitutes a form of improper input validation that leads to an unintended code execution path within the image processing subsystem. By manipulating the metadata associated with the /DCTDecode stream, an attacker can cause Pillow to interpret JPEG data as a different format or invoke a parser not designed for that specific context. This behavior aligns with CWE-20 Improper Input Validation and potentially CWE-94 Improper Control of Generation of Code (Code Injection), depending on how the misparsed image data is subsequently handled by the application. The vulnerability exploits the trust relationship between pypdf and Pillow, assuming that the library will correctly route decoding tasks based solely on the declared filter type without verifying the integrity or consistency of the underlying binary data against known signatures for JPEG files.
The operational impact of this vulnerability can vary significantly depending on how the parsed image is utilized by the host application. If the misparsed image data leads to memory corruption, buffer overflows, or arbitrary code execution within the Pillow process space, it could result in remote code execution (RCE) if the service processing these PDFs runs with elevated privileges. Even without direct RCE, such a flaw can lead to denial of service conditions through application crashes or infinite loops during image rendering. Furthermore, this issue highlights the risks associated with optional dependencies; while environments that do not install Pillow are unaffected, any system relying on pypdf for document processing in security-sensitive contexts must ensure that all optional components are kept up-to-date and properly configured to mitigate such supply chain-related vulnerabilities.
To address this vulnerability, organizations using pypdf should immediately upgrade to version 6.21.1 or later, where the developers have implemented stricter validation checks before delegating image decoding tasks to Pillow. This fix ensures that only valid JPEG data is passed through the /DCTDecode path and prevents the invocation of unintended parsers. Additionally, security teams should adopt a defense-in-depth strategy by validating PDF inputs at multiple layers, including schema validation for metadata fields like filter types. It is also advisable to run services processing untrusted documents in sandboxed environments with minimal privileges to limit the potential blast radius if such vulnerabilities are exploited. Regularly auditing and updating third-party dependencies remains critical, as libraries often rely on complex ecosystems where flaws in one component can cascade into broader security failures.