CVE-2026-112895

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.9.9

Description Pillow can exhaust system resources when parsing an existing PDF during an append operation. The PdfParser follows page-tree child references without tracking cycles or duplications and follows previous-trailer chains with only an exact repeated-offset guard. Consequently, deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Additionally, repeated non-cyclic /Kids references can lead to super-linear CPU and memory consumption. An attacker can trigger this by providing a specially crafted PDF to an application that calls the Image.save() function with the append parameter set to True. This can result in an uncaught RecursionError or excessive resource consumption, leading to a denial of service. The issue specifically involves the linearize page tree() and read prev trailer() functions.

Recommendations Update Pillow to version 13.0.0. As a temporary workaround, avoid using the append parameter in the Image.save() function when processing user-supplied PDF files.