CVE-2026-112406

Received Received - Intake

Infinite Loop in PDF Page Rewriting in Pillow

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112406

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 5.1.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. From versions 5.1.0 to 13.0.0, it contains a flaw where PdfParser.rewrite_pages() can enter an infinite loop while processing PDF pages. The function follows Parent relationships in the PDF page tree without detecting cycles, causing the application to consume full CPU resources and deny service.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of Pillow (5.1.0 to 13.0.0). Run: pip show Pillow to check the installed version. If the version is within the affected range, the system is vulnerable.

Impact Analysis

An attacker could exploit this by providing a malicious PDF with a cyclic page tree to an application using Pillow to append images. This would cause the application to hang at 100% CPU usage, leading to denial of service and preventing normal operations.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. Use: pip install --upgrade Pillow. If upgrading is not possible, avoid processing untrusted PDF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70