CVE-2026-112406: Pillow Infinite Loop Vulnerability in PdfParser
Summary
CVE-2026-112406: Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle. Affects pillow versions >= 5.1.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and versatility in handling images. However, it has a vulnerability in its PdfParser component that can lead to an infinite loop when processing certain malformed PDF files, specifically those with a cyclic parent-child relationship in the page tree structure.
Vulnerability Detail
The vulnerability arises from an infinite loop in the PdfParser.rewrite_pages() function when it encounters a page tree with a cyclic parent reference. This issue can cause applications that attempt to append images to existing PDFs to hang indefinitely, consuming one CPU core at 100% usage. The loop occurs because the function does not keep track of visited nodes in the parent chain, leading to a situation where it continuously revisits the same nodes without termination. This vulnerability is classified as high severity with a CVSS score of 8.7, as it can lead to denial of service in applications that rely on Pillow for PDF manipulation.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid appending images to PDFs that you do not control or generate. If you must work with user-supplied PDFs, implement a timeout mechanism in your application to prevent indefinite hangs when processing PDFs.
Conclusion
The CVE-2026-112406 vulnerability in Pillow's PdfParser poses a significant risk to applications that manipulate PDF files. By updating to the latest version of Pillow, developers can mitigate this risk and ensure their applications remain stable and secure.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112406 is a vulnerability in the Pillow library that causes an infinite loop in the PdfParser when processing certain malformed PDF files.
If your application uses Pillow to append images to PDFs, it may hang indefinitely when processing PDFs with cyclic parent references, leading to potential denial of service.
The vulnerability affects all versions of Pillow from 5.1.0 up to, but not including, 13.0.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update Pillow right away, avoid processing user-supplied PDFs or implement a timeout mechanism to prevent indefinite hangs.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
