CVE-2026-113786

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

• CWE-20
• CWE-183

• https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07
• https://github.com/py-pdf/pypdf/pull/4222
• https://github.com/py-pdf/pypdf/releases/tag/6.21.1
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv

Published

Oct 21, 2026

Last Modified

Oct 21, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113743A weakness has been identified in Tenstorrent tt-metal up to…6.3
• CVE-2026-113744A security vulnerability has been detected in Tenda AC19 16.…10
• CVE-2026-11375IBM MQ could allow an authenticated attacker to cause a deni…8.8
• CVE-2026-113776virtualenv is a tool for creating isolated virtual python en…7.8
• CVE-2026-113779The pfSense REST API package is an unofficial, open-source R…8.8
• CVE-2026-11378IBM MQ could allow an authenticated attacker to cause a deni…8.8
• CVE-2026-11379GitLab has remediated an issue in GitLab EE affecting all ve…5.3
• CVE-2026-1138A flaw has been found in UTT 进取 520W 1.7.7-180627. This affe…8.8
• CVE-2026-11380The JetWidgets For Elementor plugin for WordPress is vulnera…6.4
• CVE-2026-113802Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contai…9.8
• CVE-2026-113808A Stored Cross-Site Scripting vulnerability exists in the SN…7.1
• CVE-2026-11381IBM MQ could allow an authenticated attacker to cause a deni…8.8