What’s Vulnerable › Vulnerabilities

CVE-2026-112391: Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-19 · updated 2026-10-23
• Weakness: CWE-835

Description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.

Affected products

• python-pillow Pillow: from 5.1.0 before 13.0.0 — fixed in 13.0.0
• Pypi Pillow: from 5.1.0 before 13.0.0; 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.4.0 (+43) — fixed in 13.0.0

How to fix

Upgrade to a fixed version: python-pillow Pillow 13.0.0; Pypi Pillow 13.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h

Get alerted when CVE-2026-112391 or the next vulnerability affects your stack