CVE-2026-59936

EUVD-2026-42366
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.27%
Affected Products (NVD)
VendorProductVersion
pypdf_projectpypdf
𝑥
< 6.14.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pypdf
bookworm
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
pypdf2
bookworm
postponed
bullseye
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pypdf
jammy
dne
noble
needs-triage
questing
ignored
resolute
needs-triage
pypdf2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
dne
resolute
dne
Common Weakness Enumeration
References
https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b
https://github.com/py-pdf/pypdf/pull/3891
https://github.com/py-pdf/pypdf/releases/tag/6.14.1
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr