CVE-2026-113795 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using the pypdf library should assess exposure and prioritize upgrading to version 6.20.0 or later to mitigate potential memory usage issues. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and monitor PDF processing for potential memory usage issues.

Why it matters

CVE-2026-113795 is a vulnerability in the pypdf library that can lead to large memory usage when processing PDFs with multiple filters. Defenders should prioritize upgrading to version 6.20.0 or later and monitor for potential issues.

• Potential for large memory consumption leading to performance issues
• Need for verification of affected versions and exposure
• Priority for upgrading to fixed version 6.20.0 or later
• Monitoring for suspicious PDF processing activity

Technical summary

The pypdf library is vulnerable to large memory usage when processing PDFs with streams that have multiple filters. This issue can be exploited by crafting a PDF that leads to significant memory consumption. The vulnerability is addressed in pypdf version 6.20.0, which includes fixes for handling streams with multiple filters. Defenders should prioritize upgrading to version 6.20.0 or later to address potential large memory usage issues with streams having multiple filters. The issue requires accessing streams with multiple filters or large amounts of data.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.20.0 or later to address potential large memory usage issues with streams having multiple filters.

Recommended defensive actions

• Upgrade to pypdf version 6.20.0 or later
• Apply changes from PR #4173 if upgrade is not possible
• Review and monitor PDF processing for potential memory usage issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item indicate that an attacker can craft a PDF leading to large memory consumption by accessing streams with multiple filters. This issue is fixed in pypdf version 6.20.0. Defenders should verify affected versions and exposure, and prioritize upgrading to version 6.20.0 or later. Evidence is limited to CVE and source item details, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.