CVE-2026-96640 in Pillow
Summary
by MITRE • 10/21/2026
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in the Python imaging library Pillow affects versions ranging from 5.1.0 through 13.0.0, specifically within the PdfParser.linearize_page_tree() function located in src/PIL/PdfParser.py. This component is responsible for processing and linearizing PDF documents to optimize their display order on web servers or other clients that support progressive loading. The core technical flaw lies in how this function interprets the structural graph of a PDF document, specifically focusing on the /Pages object hierarchy which defines the tree structure of pages within the file. In standard PDF specifications, the page tree is represented as a directed acyclic graph where nodes can share children to reduce file size and maintain consistency across different views or modifications. However, Pillow's implementation incorrectly assumes that this structure is always a strict tree without duplicate references, failing to track or detect indirect references that point to the same child /Pages node multiple times within the input document.
When an attacker provides a maliciously crafted PDF file containing repeated references to the same child /Pages node via its /Kids arrays, Pillow's processing logic fails to recognize these as shared subtrees. Instead of treating them as single entities, the library expands each reference into distinct page entries during the linearization process. This behavior is particularly dangerous when combined with the Image.save() method using the format parameter set to PDF and append mode enabled. In such scenarios, the application attempts to merge new content with an existing PDF file that contains this malformed structure. As Pillow iterates through the /Kids arrays without deduplication logic, it generates exponentially many page references relative to the depth and branching factor of the malicious graph. This results in a massive increase in memory allocation and computational overhead as the library tries to process and linearize these redundant entries before completing the append operation.
The operational impact of this vulnerability is primarily a denial-of-service condition characterized by disproportionate CPU consumption and potential resource exhaustion. Because the expansion of page references grows exponentially rather than linearly, even a compact malformed PDF can trigger significant processing delays or cause the application to hang indefinitely. This behavior aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the system fails to limit the amount of resources used in response to user input. Furthermore, this flaw maps to MITRE ATT&CK technique T1496, Host File System Discovery or more broadly under resource hijacking behaviors where an attacker leverages inefficient processing logic to degrade service availability for legitimate users. The vulnerability does not appear to allow remote code execution directly but serves as a potent vector for disrupting services that rely on Pillow for PDF manipulation tasks such as document merging, conversion, or archival processes.
Mitigation strategies must focus primarily on upgrading the Pillow library to version 13.0.0 or later, where this logic error has been corrected by implementing proper tracking of duplicate indirect references within the page tree structure. For environments that cannot immediately upgrade due to dependency constraints, defensive coding practices should be employed when handling untrusted PDF inputs. This includes validating the structural integrity of incoming documents before passing them to Pillow's processing functions and setting strict timeouts or resource limits on image operations to prevent runaway processes from consuming system resources indefinitely. Additionally, input sanitization routines can be implemented to detect abnormally deep or repetitive structures in PDF metadata that deviate from standard compliance profiles defined by ISO 32000-1, thereby filtering out potentially malicious files before they reach the vulnerable parsing logic.