CVE-2026-113792 py-pdf CVE debrief

Who should care

Defenders responsible for systems using pypdf should assess exposure and prioritize upgrading to version 6.20.1 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or use pypdf in their environments. Verification of exposure and remediation is necessary to prevent potential denial-of-service attacks.

Why it matters

Defenders should care about CVE-2026-113792 because it allows an attacker to craft a PDF that leads to an infinite loop in pypdf's PdfWriter.find_outline_item, potentially causing denial of service. The issue has been fixed in pypdf version 6.20.1, and defenders should prioritize upgrading to this version or later. Verification of exposure and remediation is necessary.

• Potential denial of service due to infinite loop
• Need to verify and upgrade to fixed version

Technical summary

The vulnerability in pypdf allows an attacker to craft a PDF that leads to an infinite loop when calling find_outline_item on a PdfWriter. This issue has been fixed in pypdf version 6.20.1. The vulnerability is a denial-of-service issue that can be triggered by processing a specially crafted PDF. Defenders should prioritize upgrading to pypdf version 6.20.1 or later to prevent potential infinite loops when using PdfWriter.find_outline_item. The issue requires verification of exposure and remediation to prevent potential denial-of-service attacks.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.20.1 or later to prevent potential infinite loops when using PdfWriter.find_outline_item.

Recommended defensive actions

• Upgrade to pypdf version 6.20.1 or later
• Apply changes from PR #4188 if an upgrade is not possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability allows an attacker to craft a PDF that leads to an infinite loop when calling find_outline_item on a PdfWriter. This issue has been fixed in pypdf version 6.20.1. Evidence of exposure includes verification of pypdf versions prior to 6.20.1 being used in environments where untrusted PDFs are processed. Defenders should verify and upgrade to the fixed version. The source item and CVE record provide details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.