CVE-2026-96640

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0

Description The PdfParser.linearize page tree() function in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When the Image.save() function is used with format="PDF" and append=True to process a malformed PDF where /Kids arrays repeatedly reference the same child /Pages node, the library expands the shared subtree as distinct pages. This can lead to the creation of exponentially many page references, resulting in disproportionate CPU consumption.

Recommendations Update to version 13.0.0.