Security · Pillow
Pillow's PDF parser recurses without limit when appending
PdfParser can recurse without limit in get_value() and linearize_page_tree().
- Advisory
- CVE-2026-112391 (also GHSA-254f-3936-288h)
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 6.3 out of 10, as published
- Affected
- >= 5.1.0, < 13.0.0
- Fixed in
- 13.0.0
- Reaches you
- on a save path
What triggers it
Image.save(..., format="PDF", append=True) onto an attacker-controlled existing PDF.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
Reached only through Pillow's PDF append path, which Image.open never runs.
How to protect yourself
In general. Upgrade to Pillow 13.0.0. Do not append to PDFs you did not make.
Specifically. Not a pre-decode matter.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-254f-3936-288h
- The record entry, triaged 2026-11-01, last checked 2026-11-01