Tetrak
GitHub ↗
Security · Pillow

PdfParser recurses without bound on a cyclic page tree or trailer chain

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Advisory
CVE-2026-112895
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Appending to an existing PDF with Image.save(format="PDF", append=True); Image.open never reads a PDF.

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

The existing PDF is the input, so the check belongs in front of it: the format gate and pdfinfo's time limit apply. But the trigger is a /Kids cycle in the page tree, or a long chain of distinct /Prev offsets, in the object graph, which a bounded check does not parse and pdfinfo's summary does not show. Out of a pre-decode check's reach.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Run the check on a PDF before appending to it, for what it does see; append only to PDFs the program wrote itself; upgrade to a Pillow with the fix.

The general advice applies to every row here.

Sources