Bug 2558315 (CVE-2026-113786)
| Summary: | CVE-2026-113786 pypdf: pypdf: Denial of Service via unintended image parser invocation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | anpicker, bbrownin, blitton, doconnor, dschmidt, ebourniv, hasun, ikhan, jfula, jlanda, jowilson, kshier, mbarnett, nyancey, ometelka, ptisnovs, rbobbitt, sbunciak, simaishi, stcannon, syedriko, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in pypdf. A remote attacker could trigger a Denial of Service (DoS) or unexpected behavior by enticing a user or service to process a specially crafted PDF document. When an image marked with a JPEG filter is loaded, pypdf fails to restrict decoding to the JPEG format before passing the data to the Pillow image library. Consequently, an unintended image parser is invoked to process the malformed data, potentially leading to application errors or instability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-21 15:13:03 UTC
|