CVE-2026-112391Medium· 6.3▾ SunlitPillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.
Pillow >= 5.1.0, < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112390High· 8.2Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112406High· 8.7Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112900Critical· 9.2Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112893High· 8.2Pillow: Invalid free in FreeType glyph rendering when a stroker is active
CVE-2026-112895High· 8.7Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112894High· 8.7Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)