CVE-2026-113786

— UNSCOREDpublic exploit available

Published 2026-10-21 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

Weaknesses

CWE-20, CWE-183

Public exploit & PoC references

https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07
https://github.com/py-pdf/pypdf/pull/4222
https://github.com/py-pdf/pypdf/releases/tag/6.21.1
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv

All references

https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07
https://github.com/py-pdf/pypdf/pull/4222
https://github.com/py-pdf/pypdf/releases/tag/6.21.1
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-115915PoC
LOWCVE-2020-37289PoC
UNSCOREDCVE-2023-5649
MEDIUMCVE-2024-6423
MEDIUMCVE-2025-31980
MEDIUMCVE-2025-32000
CRITICALCVE-2025-71383
HIGHCVE-2026-100113

Related by shared AI tags and CWE weakness class. Browse the full archive.