CVE-2026-113794

EUVD-2026-107335
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58
https://github.com/py-pdf/pypdf/issues/4169
https://github.com/py-pdf/pypdf/pull/4170
https://github.com/py-pdf/pypdf/releases/tag/6.20.0
https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3