CVE-2026-112895: Pillow Unbounded Recursion in PDF Parsing
Summary
CVE-2026-112895: When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Affects pillow versions >= 5.1.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. However, it has a vulnerability related to its PDF handling functionality, specifically when appending to existing PDF files. This vulnerability can lead to unbounded recursion, causing applications to crash or consume excessive CPU and memory resources.
Vulnerability Detail
The vulnerability arises when Pillow's PdfParser processes a PDF file with cyclic or duplicated page trees. The functions 'linearize_page_tree' and 'read_prev_trailer' do not implement effective cycle detection or depth limits, allowing for infinite recursion. This can lead to a denial of service, as the application may exhaust system resources before any image processing occurs. The issue is a follow-up to CVE-2026-42310, which attempted to address similar recursion problems but did not cover all cases.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update Pillow immediately, avoid using the 'append=True' option when saving PDFs, or ensure that the PDFs you are processing do not contain cyclic or duplicated page trees. Here is an example of how to save a PDF without appending: 'Image.save('output.pdf', format='PDF')'.
Conclusion
CVE-2026-112895 is a significant vulnerability in the Pillow library that can lead to unbounded recursion when processing certain PDF files. It is crucial for developers using Pillow to update to the latest version to mitigate this risk. Additionally, using Vulert can help keep your applications secure by monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112895 is a vulnerability in the Pillow library that allows for unbounded recursion when parsing PDF files, potentially leading to denial of service.
If your application uses Pillow to process PDFs, it may crash or become unresponsive when handling certain malformed PDF files due to excessive resource consumption.
Versions of Pillow from 5.1.0 up to, but not including, 13.0.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2026-112895 is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
