CVE-2026-112894

Received Received - Intake

Pillow PDF Object ID Reservation Quadratic Time Issue

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112894

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 5.1.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is in Pillow, a Python imaging library. It occurs when saving multi-frame images as PDFs with save_all enabled. The library takes quadratic time to reserve PDF object identifiers, causing excessive CPU usage. An attacker can exploit this by providing a small APNG with a large declared frame count, leading to a denial-of-service condition.

Detection Guidance

Check if your system uses Pillow versions between 5.1.0 and 13.0.0 by running: pip show Pillow. If installed, verify the version number. Monitor CPU usage spikes when processing multi-frame images or converting to PDF.

Impact Analysis

This vulnerability can cause high CPU usage and system slowdowns when processing certain image files. In severe cases, it may lead to a denial-of-service, making applications unresponsive or crashing. Systems using Pillow for PDF conversion are particularly affected.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later using: pip install --upgrade Pillow. If upgrading is not possible, avoid using save_all=True when saving multi-frame images to PDF.

Hi! I’m here to help you understand CVE-2026-112894. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70