CVE-2026-113794: pypdf: Possible infinite loop when hitting EOF in standard xref table

Q: Which deployments are exposed to this issue?

Deployments using pypdf versions before 6.20.0 are affected when they process attacker-controlled or otherwise untrusted PDF files. The malicious file must be incomplete and end within a standard cross-reference table.

Q: What does successful exploitation require?

An attacker needs to supply a specially crafted truncated PDF that reaches pypdf for processing. The condition is triggered by an unexpected end of file while pypdf is reading the standard xref table.

Q: What should we do if upgrading is not immediately possible?

Apply the changes from PR #4170 as a temporary workaround. Otherwise, avoid processing untrusted incomplete PDFs until pypdf can be updated to version 6.20.0.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.

Patches

This has been fixed in pypdf==6.20.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4170.

Notes

This has been reported through both the secure channel and as a public issue at #4169.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.20.0

pip/pypdf<6.20.0

6.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0

Event History

Oct 21, 2026

CVE Published

via MITRE·03:59 PM

Data Sourced

via MITRE·03:59 PM

DescriptionWeakness

Advisory Published

via GitHub·04:54 PM

Data Sourced

via GitHub·04:54 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf versions before 6.20.0 are affected when they process attacker-controlled or otherwise untrusted PDF files. The malicious file must be incomplete and end within a standard cross-reference table.

What does successful exploitation require?

An attacker needs to supply a specially crafted truncated PDF that reaches pypdf for processing. The condition is triggered by an unexpected end of file while pypdf is reading the standard xref table.

What should we do if upgrading is not immediately possible?

Apply the changes from PR #4170 as a temporary workaround. Otherwise, avoid processing untrusted incomplete PDFs until pypdf can be updated to version 6.20.0.

CVE-2026-113794: pypdf: Possible infinite loop when hitting EOF in standard xref table

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does successful exploitation require?

What should we do if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does successful exploitation require?

What should we do if upgrading is not immediately possible?