CVE-2026-112406: Pillow Python Library DOS Vulnerability

CVE-2026-112406 Overview

CVE-2026-112406 is a denial of service vulnerability in Pillow, the widely used Python imaging library. The flaw affects versions from 5.1.0 up to (but not including) 13.0.0. The PdfParser.rewrite_pages() function follows Parent relationships in a PDF page tree without detecting cycles. An attacker who supplies a crafted cyclic PDF to an application that appends an image to that PDF can trigger an infinite loop. The affected worker consumes full CPU and stops processing legitimate requests. The issue is categorized as uncontrolled resource consumption through an unreachable exit condition [CWE-835].

Critical Impact
Any Python service that uses Pillow to append images to attacker-supplied PDFs can be stalled at 100% CPU, denying service to legitimate users.

Affected Products

Pillow versions 5.1.0 through 12.x (all releases prior to 13.0.0)
Python applications invoking PIL.PdfParser.rewrite_pages() on untrusted PDF input
Downstream frameworks and services that embed Pillow for PDF manipulation

Discovery Timeline

2026-10-19 - CVE-2026-112406 published to NVD
2026-10-20 - Last updated in NVD database
Fixed in - Pillow release 13.0.0 via upstream commit b3ebf20c

Technical Details for CVE-2026-112406

Vulnerability Analysis

The vulnerability resides in src/PIL/PdfParser.py, specifically within PdfParser.rewrite_pages(). When Pillow rewrites a PDF to append new page content, it traverses the page tree by walking Parent references. The traversal loop assumes the page tree is acyclic. A PDF whose nodes form a cycle (for example, node A referencing B as parent, and B referencing A) causes the while loop to iterate indefinitely. The worker thread never returns, holding the CPU and blocking subsequent work.

Root Cause

The root cause is a missing cycle check during page tree traversal. The deletion routine iterating pages_tree_nodes_to_delete dereferences each node's parent without recording visited references. The PDF specification does not guarantee acyclic trees in untrusted input, so parsers must defend against malformed structures.

Attack Vector

Exploitation requires only that the vulnerable application accept a PDF from an attacker and invoke the Pillow PDF append flow. No authentication, user interaction, or privileges are required when the service exposes a document-processing endpoint. The attack is network-reachable in typical web upload scenarios. Impact is limited to availability; no code execution or data disclosure occurs.

python

# Patch excerpt from src/PIL/PdfParser.py
# Prevent infinite loop when rewriting PDF pages (#10125)
                    self.pages[j] = new_page_ref
        # delete redundant Pages tree nodes from xref table
        for pages_tree_node_ref in pages_tree_nodes_to_delete:
-            while pages_tree_node_ref:
+            processed_refs = []
+            while pages_tree_node_ref and pages_tree_node_ref not in processed_refs:
+                processed_refs.append(pages_tree_node_ref)
                pages_tree_node = self.cached_objects[pages_tree_node_ref]
                if pages_tree_node_ref.object_id in self.xref_table:
                    del self.xref_table[pages_tree_node_ref.object_id]

Source: GitHub Pillow Commit b3ebf20c

The fix introduces a processed_refs list that records each visited pages_tree_node_ref. The loop terminates once a previously seen reference reappears, breaking the cycle.

Detection Methods for CVE-2026-112406

Indicators of Compromise

Python worker processes consuming sustained 100% CPU on a single core after processing a user-supplied PDF.
Request timeouts or queue backlogs in services that invoke PIL.PdfParser on uploaded documents.
Uploaded PDFs whose page tree objects contain mutually referencing /Parent entries.

Detection Strategies

Inventory Python environments for Pillow versions between 5.1.0 and 12.x using pip list or software composition analysis tooling.
Instrument document-processing workers with per-request CPU time and wall-clock limits to surface runaway iterations.
Review application logs for repeated worker restarts correlated with PDF upload endpoints.

Monitoring Recommendations

Alert when any single Pillow worker exceeds a defined CPU-seconds threshold per request.
Track upload sources and file hashes submitting PDFs that trigger worker timeouts for later correlation.
Capture process-level telemetry from endpoints and servers running Python image pipelines so that abnormal CPU patterns are retained for investigation.

How to Mitigate CVE-2026-112406

Immediate Actions Required

Upgrade Pillow to version 13.0.0 or later in all Python environments.
Audit application code paths that call PdfParser.rewrite_pages() on untrusted input and prioritize those for patching.
Apply request-level CPU and timeout limits to document-processing workers as a defense-in-depth measure.

Patch Information

The fix is included in Pillow 13.0.0, released by the python-pillow maintainers. See the GitHub Pillow Release 13.0.0 notes and the GitHub Security Advisory GHSA-f2g6-542v-9j58 for additional context. Upgrade using pip install --upgrade Pillow>=13.0.0.

Workarounds

Validate or reject PDFs that contain cyclic parent references before passing them to Pillow.
Run PDF append operations inside a sandboxed subprocess with CPU time limits (for example, resource.setrlimit(RLIMIT_CPU, ...)).
Restrict PDF upload endpoints to authenticated users and rate-limit submissions until the upgrade is deployed.

bash

# Upgrade Pillow to the fixed release
pip install --upgrade 'Pillow>=13.0.0'

# Verify installed version
python -c "import PIL; print(PIL.__version__)"