CVE-2026-59936: pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page tex…

7.5CVSS Score

HIGHSeverity

NOCISA KEV

0.3%EPSS Score

VulnerabilityImpact Type

📋 Vulnerability Details

CVE ID	CVE-2026-59936
Vendor	pip
Affected Product	pypdf
Vulnerability Type	Vulnerability
CVSS Score	7.5 (HIGH)
EPSS Score	0.3% probability of exploitation in the next 30 days
Actively Exploited	❌ No known exploitation
Patch Status	See Vendor Advisory →
Reported By	CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories)

🔬 Technical Analysis

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.

Patches This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1).

Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891).

🎯 Known Indicators of Compromise

{"type":"url","value":"https://github.com/py-pdf/pypdf/releases/tag/6.14.1).","confidence_score":0.82,"first_seen":"2026-07-23","source_count":1} {"type":"url","value":"https://github.com/py-pdf/pypdf/pull/3891).","confidence_score":0.82,"first_seen":"2026-07-23","source_count":1}

📚 Advisory References

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-59936 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries

🛡️ Get Detection Pack → 🔌 Access via API →