CVE-2026-112895 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the Pillow Python imaging library represents a significant resource exhaustion flaw affecting versions from 5.1.0 through 13.0.0. As a widely adopted library for image processing, Pillow handles various file formats including PDFs, which are frequently used in document management and data exchange workflows. The core of this vulnerability lies within the PdfParser component responsible for parsing existing PDF files during append operations. When an application utilizes Image.save with PDF append enabled to merge or modify documents, it triggers specific code paths that fail to adequately validate the structural integrity and complexity of the input file before processing. This lack of validation allows maliciously crafted PDFs to exploit internal logic errors, leading to severe performance degradation or complete system unavailability for the affected application.
The technical root cause is a failure in cycle detection and depth limiting during the traversal of the PDF object graph. Specifically, the PdfParser follows page-tree child references without implementing any form of cycle tracking or duplication prevention mechanisms. In standard PDF structures, pages are organized in a tree structure where each node may reference its children via /Kids arrays. If an attacker constructs a PDF with deep nesting or circular references among these nodes, the parser will enter infinite recursion loops as it attempts to traverse every child indefinitely. Furthermore, the handling of previous-trailer chains is equally flawed; while there is a guard against exact repeated offsets, this check is insufficient for detecting long chains of unique trailer offsets that do not repeat but still require extensive processing time and memory allocation. This design oversight means that both cyclic structures and deeply linear or complex non-cyclic structures can trigger the vulnerability.
The operational impact of this flaw is primarily denial of service through resource exhaustion. When a malicious PDF containing deep page trees, long chains of unique trailer offsets, or repeated non-cyclic /Kids references is processed, it causes super-linear consumption of CPU cycles and memory resources. In Python environments, which rely on a call stack for function execution, the unbounded recursion leads to an exhausted Python stack space. This typically manifests as an uncaught RecursionError that crashes the application process immediately. Alternatively, in cases where the recursion does not hit the immediate stack limit but still triggers excessive processing due to super-linear complexity, the system may experience prolonged high CPU usage and memory bloat before eventually failing or being terminated by operating system resource monitors. This makes it possible for an attacker to disrupt service availability simply by submitting a specially crafted PDF file through any interface that accepts image uploads or document imports using Pillow with append functionality enabled.
From a classification perspective, this vulnerability aligns closely with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption, specifically under the sub-category of Denial of Service via resource exhaustion. The attack vector involves an attacker supplying a malicious input file to trigger internal logic errors that lead to stack overflow or excessive computational load. In terms of adversarial tactics, this behavior is consistent with ATT&CK technique T1496: Resource Hijacking, where the goal is not data theft but rather the degradation of service availability by consuming system resources beyond acceptable thresholds. The lack of proper input validation and depth limiting in recursive parsing routines is a common pattern in parser vulnerabilities that can be mitigated through stricter structural constraints during file ingestion.
To mitigate this risk, organizations relying on Pillow for PDF processing must upgrade to version 13.0.0 or later, where the issue has been resolved by implementing proper cycle detection and depth limiting mechanisms within the PdfParser. Until an upgrade is feasible, defensive measures should include validating input files before they reach the parsing stage, such as checking file size limits and using sandboxed environments with strict resource quotas for processing untrusted documents. Additionally, applications can implement timeout wrappers around Image.save calls to prevent indefinite hangs or excessive CPU consumption from malicious inputs. It is also advisable to review any custom integrations that use PDF append features to ensure they are not exposing the vulnerable code paths to external users without adequate safeguards.