PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113794 py-pdf CVE debrief

CVE-2026-113794: pypdf Possible infinite loop when hitting EOF in standard xref table. This vulnerability can cause an infinite loop when processing incomplete PDF files that end inside the xref table, potentially leading to denial of service. Defenders should assess exposure and prioritize upgrading to version 6.20.0 or later. The fix is included in pypdf version 6.20.0, and changes from PR #4170 can be applied if an upgrade is not possible immediately. It was reported through both the secure channel and as a public issue at #4169.

Vendor
py-pdf
Product
pypdf
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for PDF processing workflows, particularly those using pypdf versions prior to 6.20.0, should assess exposure and prioritize upgrading to prevent potential infinite loops. This includes operators, platform administrators, vulnerability management teams, and security teams who manage PDF processing systems. They should review and apply changes from PR #4170 if an upgrade is not possible immediately and verify PDF files for completeness

Why it matters

CVE-2026-113794 is a vulnerability in the pypdf library that can cause an infinite loop when processing incomplete PDF files. Defenders should prioritize upgrading to version 6.20.0 or later to prevent potential exposure.

  • Potential denial of service due to infinite loop
  • Need to verify PDF processing workflows for exposure
  • Prioritize upgrading to pypdf version 6.20.0 or later
  • Review and apply changes from PR #4170 if upgrade is not possible

Technical summary

The pypdf library is vulnerable to an infinite loop when processing incomplete PDF files that end inside the xref table. An attacker can craft a PDF to trigger this vulnerability, which may lead to denial of service. The vulnerability is fixed in pypdf version 6.20.0. Defenders should prioritize upgrading to prevent potential exposure. The issue was reported through both the secure channel and as a public issue at #4169, and changes from PR #4170 can be applied if an immediate upgrade is not possible. This vulnerability affects PDF processing workflows, particularly those using pypdf versions prior to 6.20.0.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.20.0 or later to prevent potential infinite loops when processing incomplete PDF files.

Recommended defensive actions

  • Upgrade to pypdf version 6.20.0 or later
  • Apply changes from PR #4170 if upgrade is not possible
  • Review PDF processing workflows for potential exposure
  • Verify PDF files for completeness before processing
  • Implement monitoring for signs of infinite loops
  • Conduct a thorough review of affected systems and assets
  • Track exceptions and retest remediated assets

Evidence notes

The vulnerability was reported through both the secure channel and as a public issue at #4169. The fix is included in pypdf version 6.20.0. An attacker can craft a PDF to trigger this vulnerability, which requires an incomplete file that ends inside the xref table. Defenders should verify PDF processing workflows for exposure and prioritize upgrading to prevent potential infinite loops.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113794 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113794

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113794 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113794

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • pypdf: Possible infinite loop when hitting EOF in standard xref table

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/PyPI/GHSA-39mj-jf6j-2qj3.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf/issues/4169

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf/pull/4170

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/py-pdf/pypdf/releases/tag/6.20.0

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.