CVE-2026-112894: Pillow Quadratic-time DoS in PDF save_all Functionality
Summary
CVE-2026-112894: Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id). Affects pillow versions >= 5.1.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It supports multiple image formats, including GIF, PNG, JPEG, and TIFF, and is commonly utilized in web applications for image processing tasks. However, a vulnerability has been identified in its PDF saving functionality, specifically when handling multi-frame images, which can lead to significant performance degradation.
Vulnerability Detail
The vulnerability arises from a quadratic-time Denial of Service (DoS) in the PDF saving process, particularly in the PdfParser.next_object_id method. When saving multi-frame images as multi-page PDFs, the time taken is proportional to the square of the number of frames. This means that an attacker can exploit this by uploading specially crafted images, causing the application to consume excessive CPU resources for an extended period. The issue is exacerbated by the fact that the application does not validate the frame count before processing, allowing even small files with a high declared frame count to trigger the slowdown.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the save_all=True option when saving images as PDFs, especially when handling user-uploaded images. This can prevent the application from entering the vulnerable code path.
Conclusion
CVE-2026-112894 represents a significant vulnerability in the Pillow library that can lead to denial of service through CPU exhaustion. It is crucial for developers using Pillow to update to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112894 is a vulnerability in the Pillow library that allows for a quadratic-time Denial of Service when saving multi-frame images as PDFs.
If your application processes user-uploaded images and saves them as PDFs using Pillow, an attacker could exploit this vulnerability to consume excessive CPU resources, leading to a denial of service.
The vulnerability affects Pillow versions from 5.1.0 up to, but not including, 13.0.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2026-112894 using the Vulert playground without requiring any signup.
The CVSS score for CVE-2026-112894 is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
