Description
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.
Published: 2026-10-19
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The flaw allows Pillow to recurse without limit while parsing nested PDF objects during append operations. This can raise an uncaught RecursionError or terminate processes, which results in denial of service. The weakness is a classic uncontrolled recursion (CWE-835).

Affected Systems

The Pillow imaging library, distributed as python-pillow:Pillow, is vulnerable in all released versions from 5.1.0 through 13.0.0.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS information is unavailable, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a crafted PDF file with deeply nested objects supplied to an application that uses Pillow with PDF append enabled. An attacker could trigger a RecursionError or crash the worker process, leading to a denial of service.

Generated by OpenCVE AI on October 19, 2026 at 21:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pillow to version 13.0.0 or later.
  • If possible, disable the PDF append feature or otherwise prevent the library from processing append data.
  • Validate PDFs before parsing, limiting the depth of nested objects or enforcing a recursion limit in a sandboxed environment.

Generated by OpenCVE AI on October 19, 2026 at 21:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Python-pillow
Python-pillow pillow
Vendors & Products Python-pillow
Python-pillow pillow

Mon, 19 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.
Title Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Python-pillow Pillow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-19T20:40:36.285Z

Reserved: 2026-10-19T16:58:51.958Z

Link: CVE-2026-112391

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T21:17:07.477

Modified: 2026-10-19T21:17:07.477

Link: CVE-2026-112391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T21:30:03Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')