CVE-2026-42310

Name of the Vulnerable Software and Affected Versions Pillow versions 4.2.0 through 12.1.x

Description A flaw in the PdfParser allows an attacker to supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This occurs because the parser follows Prev pointers in PDF trailers to read cross-reference sections; if a pointer references an offset already processed, either by pointing to itself or forming a cycle, the parser enters an infinite loop.

Recommendations Update to version 12.2.0.