Pillow: Denial of service via infinite loop in PDF page tree rewriting
Summary
Pillow, a Python imaging library, can enter an infinite loop when an application appends an image to an existing PDF whose page tree contains a /Parent cycle. The affected function PdfParser.rewrite_pages() follows Parent references without detecting cycles. An attacker who can supply such a crafted PDF can keep a worker process at full CPU usage and cause a denial of service; confidentiality and integrity are not affected. Only applications that call Pillow's PDF append function on attacker-supplied files are exposed.
Affected
- Pillow from 5.1.0 up to and including 12.3.0 (advisory lists 5.1.0 to 12.3.0; NVD lists before 13.0.0)
Fixed in
- Pillow 13.0.0
Workaround
- No vendor workaround documented.
- Do not append images to PDFs from untrusted sources until Pillow is upgraded.
- Alternatively, validate untrusted PDFs before the append step.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof-of-concept or known exploitation found in the sources checked. The CISA KEV catalogue was not checked directly.
Our recommendation
- Identify all Python environments and container images that include Pillow, including transitive dependencies.
- Upgrade Pillow to version 13.0.0 or later.
- Prioritise internet-facing upload or document processing workflows that append images to PDFs.
- Enforce timeouts and worker limits for document processing jobs.
- Monitor for processes stuck at high CPU usage.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA advisory GHSA-f2g6-542v-9j58 github.com
- Fix commit b3ebf20 github.com
- Pillow 13.0.0 release github.com
- OSV BIT-pillow-2026-112406 osv.dev
- Ubuntu CVE-2026-112406 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:53.
Original description (NVD)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.