CVE-2026-112406
highPillow is a Python imaging library.
Vendor / product: Python — pillow
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-19 22:17
Modified: 2026-10-27 14:59
NVD status: Analyzed
Last synced 20 hours ago
Verified against the source API 2026-10-28 11:30 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / pillow ≥5.1.0 <13.0.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777
Patch / mitigation: https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58
References
- https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777 security-advisories@github.com
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 security-advisories@github.com
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 11:30 UTC · record ↗