cyfenced.com →

[ CVE-2026-112406 · Published 19 Oct 2026 ]

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

CVSS 8.7 EPSS <1%Fix available

[ Description ]Official description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.

[ Fixes ]Fixes and patches

  • Pillow 13.0.0Fixed version · GitHub Advisories · pip package Pillow: upgrade to 13.0.0 or later (affected >= 5.1.0, < 13.0.0)

[ Packages ]Affected open-source packages

[ References ]References