CVE-2026-59936: pypdf: Possible infinite loop for not terminated inline images
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
Patches
This has been fixed in pypdf==6.14.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3891.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.14.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.14.1 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891) to address the infinite loop triggered by a PDF page content stream with a not terminated inline image during parsing (e.g., when extracting page text).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59936?
CVE-2026-59936 has a high severity rating of 8.7.
How do I fix CVE-2026-59936?
To fix CVE-2026-59936, update the pypdf library to version 6.14.1 or later.
What does CVE-2026-59936 affect?
CVE-2026-59936 affects the pypdf library, which is used for processing PDF files.
What kind of vulnerability is CVE-2026-59936?
CVE-2026-59936 is a denial-of-service vulnerability due to a possible infinite loop caused by improperly terminated inline images.
When was CVE-2026-59936 published?
CVE-2026-59936 was published on July 8, 2026.