CVE-2026-112406

EUVD-2026-104648
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 20.52%
Debian logo
Debian Releases
Debian Product
Codename
pillow
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
13.0.0-1
fixed
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58