Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

🗓️ 20 Oct 2026 20:50:49Reported by GitHub Advisory DatabaseType

Unbounded recursion in Pillow PdfParser parsing PDF page trees or trailer chains.

Reporter	Title	Published	Views	Family All 128
IBM Security Bulletins	Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0	4 Aug 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
attackerkb	CVE-2026-42310	9 May 202604:10	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-1712)	27 May 202600:00	–	nessus
Tenable Nessus	Debian dsa-6357 : python-pil-doc - security update	21 Jun 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-2559)	10 Jul 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-2619)	10 Jul 202600:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2751)	21 Jul 202600:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.12.0 : python-pillow (EulerOS-SA-2026-2797)	21 Jul 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-2902)	6 Aug 202600:00	–	nessus

Vulners

Node

python pillowRange5.1.0–13.0.0pip

Source	Link
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-112895
github	www.github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf
github	www.github.com/python-pillow/Pillow/releases/tag/13.0.0
github	www.github.com/advisories/GHSA-p4wg-p73j-c528

20 Oct 2026 20:50Current

6.6Medium risk

Vulners AI Score6.6

CVSS 48.7

CVSS 3.15.5

EPSS0.00291

SSVC