Pillow: Denial of service via unbounded recursion in PDF append parsing
Summary
Pillow, the Python imaging library, can exhaust the call stack or consume excessive CPU and memory when it parses an existing PDF during an append operation. Cyclic or duplicated page trees and long chains of unique trailer offsets are not bounded. An attacker can exploit this by supplying a crafted PDF to an application that calls Image.save with PDF append enabled, causing an uncaught RecursionError or heavy resource use before output is written. The issue is an incomplete fix for CVE-2026-42310.
Affected
- Pillow 5.1.0 up to and including 12.3.0 (per the GitHub advisory, as stated in the CVE record: >= 5.1.0, < 13.0.0)
Fixed in
- Pillow 13.0.0
Workaround
- No vendor-documented workaround. Upgrade to Pillow 13.0.0.
- Interim measure (not from the vendor): do not use append=True on PDFs from untrusted users, or process such files in an isolated worker with CPU and memory limits.
Exploitation
- Not known to be exploited. CISA SSVC: exploitation none, automatable yes, technical impact partial.
- The GHSA advisory includes a minimal reproduction; public exploitation beyond that is unknown.
Our recommendation
- Check whether Pillow is used directly or as a transitive dependency (lockfiles, container images, software inventory).
- Upgrade to Pillow 13.0.0 or later; note that Pillow 13 requires Python 3.11 or newer.
- Where possible, avoid PDF append mode for untrusted files or run such processing in an isolated worker with resource limits.
- Check your Linux distribution tracker for backport status, as it is unknown.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p4wg-p73j-c528 github.com
- Pillow fix commit e2ae7ea github.com
- Pillow 13.0.0 release github.com
- Pillow 13.0.0 release notes pillow.readthedocs.io
- OSV record for CVE-2026-112895 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:51.
Original description (NVD)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.