CVE-2026-112895: Pillow PDF Parser DOS Vulnerability

CVE-2026-112895 Overview

CVE-2026-112895 affects the Pillow Python imaging library from version 5.1.0 through 13.0.0. The vulnerability exists in the PdfParser component, which fails to track cycles or duplicates when following page-tree child references. The parser also walks previous-trailer chains using only an exact repeated-offset guard. Attackers can craft malicious PDF files that trigger a RecursionError or exhaust CPU and memory when processed by applications calling Image.save with PDF append enabled. The flaw is categorized as uncontrolled recursion [CWE-674] and results in denial of service.

Critical Impact
A remote attacker can supply a crafted PDF to any application using Pillow's PDF append functionality, causing resource exhaustion and service disruption without authentication or user interaction.

Affected Products

Pillow versions 5.1.0 through 12.x
Python applications using Image.save with PDF append enabled
Downstream libraries and services bundling vulnerable Pillow versions

Discovery Timeline

2026-10-19 - CVE-2026-112895 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112895

Vulnerability Analysis

The vulnerability resides in src/PIL/PdfParser.py within the linearize_page_tree method and related trailer-chain traversal logic. The parser recursively descends into /Kids references in PDF page trees without maintaining a visited-node set across recursive calls. A crafted PDF containing deeply nested or cyclic page trees forces the Python interpreter to exhaust its call stack, raising an uncaught RecursionError.

The trailer-chain logic contains a similar weakness. It only guards against an exact repeated offset, so a chain of unique trailer offsets bypasses the check and causes unbounded traversal. Repeated non-cyclic /Kids references additionally trigger super-linear CPU and memory consumption during linearization. The result is denial of service before any output file is written.

Root Cause

The linearize_page_tree function originally accepted a processed_ids parameter that could be reset or passed inconsistently between recursive invocations. This design permitted the same subtree to be re-traversed and allowed cyclic references to loop indefinitely until Python's recursion limit was reached. The absence of iterative traversal combined with weak chain-termination logic enables resource exhaustion from attacker-controlled PDF structures.

Attack Vector

An attacker crafts a malicious PDF file with cyclic /Kids references, deeply nested page trees, or long chains of unique trailer offsets. The attacker delivers this PDF to any Python application that passes it to Image.save with the PDF append option enabled. Common targets include document conversion services, image processing APIs, and automated report generators that accept user-supplied PDFs.

python

         return value
 
     def linearize_page_tree(
-        self, node: PdfDict | None = None, processed_ids: set[int] | None = None
+        self, node: PdfDict | None = None
     ) -> list[IndirectReference]:
-        if processed_ids is None:
-            processed_ids = set()
+        processed_ids = set()
         if node is not None:
             page_node = node
         else:

Source: GitHub Pillow Commit e2ae7eacad6. The patch removes the externally supplied processed_ids parameter and always initializes a fresh tracking set, as part of a broader change to walk the PDF page tree iteratively.

Detection Methods for CVE-2026-112895

Indicators of Compromise

Python processes terminating with RecursionError originating from PIL/PdfParser.py
Sustained high CPU or memory consumption by worker processes handling PDF uploads
Repeated out-of-memory kills or container restarts tied to PDF append operations
Application logs showing stack traces referencing linearize_page_tree

Detection Strategies

Inventory running Python environments and identify installed Pillow versions below 13.0.0 using pip list or software composition analysis
Monitor application logs for uncaught RecursionError or MemoryError exceptions in image processing code paths
Baseline normal PDF processing duration and alert on outliers that exceed expected runtimes

Monitoring Recommendations

Track CPU and memory utilization per request on services that process user-supplied PDFs
Enable structured exception logging around Image.save calls that use PDF append mode
Correlate upload metadata with process-crash telemetry to identify attacker-supplied payloads

How to Mitigate CVE-2026-112895

Immediate Actions Required

Upgrade Pillow to version 13.0.0 or later in all Python environments and container images
Audit application code for Image.save calls that enable PDF append on untrusted input
Apply request size limits and processing timeouts to PDF handling endpoints
Isolate PDF processing workers so a crash cannot cascade to the parent service

Patch Information

The fix is included in Pillow Release 13.0.0. The patch rewrites linearize_page_tree to walk the page tree iteratively and consistently tracks processed node identifiers. Details are documented in GitHub Security Advisory GHSA-p4wg-p73j-c528.

Workarounds

Disable PDF append functionality in applications that cannot immediately upgrade
Reject or sanitize untrusted PDF input before passing it to Pillow
Run PDF processing in sandboxed subprocesses with strict memory and CPU limits
Set a conservative sys.setrecursionlimit value in worker processes to fail fast on malicious input

bash

# Upgrade Pillow to the patched release
pip install --upgrade "Pillow>=13.0.0"

# Verify the installed version
python -c "import PIL; print(PIL.__version__)"