Tetrak
GitHub ↗
Security · Pillow

PdfParser inflates a PDF stream without an upper bound

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Advisory
CVE-2026-59200
Library
Pillow, pillow on PyPI
Published
Severity
7.5 out of 10, as published
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Opening an existing PDF with Pillow's PdfParser, as Image.save(append=True) does; Image.open never reads a PDF.

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

The existing PDF is the input, so the check belongs in front of it: the format gate and pdfinfo's time limit apply. But the trigger is a FlateDecode stream whose expansion is unbounded, which pdfinfo never inflates, in the object graph, which a bounded check does not parse and pdfinfo's summary does not show. Out of a pre-decode check's reach.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Run the check on a PDF before appending to it, for what it does see; append only to PDFs the program wrote itself; upgrade to a Pillow with the fix.

The general advice applies to every row here.

Sources