Tetrak
GitHub ↗
Security · Pillow

A shared page-tree graph makes Pillow's PDF append take disproportionate time

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Advisory
CVE-2026-96640
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Appending to an existing PDF with Image.save(format="PDF", append=True).

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

The existing PDF is the input, so the check belongs in front of it: the format gate and pdfinfo's time limit apply. But the trigger is a page tree that repeats the same child at every level, in the object graph, which a bounded check does not parse and pdfinfo's summary does not show. Out of a pre-decode check's reach.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Run the check on a PDF before appending to it, for what it does see; append only to PDFs the program wrote itself; upgrade to a Pillow with the fix.

The general advice applies to every row here.

Sources