EUVD-2026-107570

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion...

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

============================================================================ Quadratic-time DoS in PDF saveall PdfParser.nextobjectid Location: src/PIL/PdfParser.py:629 in nextobjectid Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via PdfParser.rewritepages in src/PIL/PdfParser.py when processing a PDF file whose /Parent chain contains a cycle. The function walks the /Parent chain of every pre-existing page upward, stopping only when it reaches a no...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the nextobjectid function in src/PIL/PdfParser.py when saving a multi-frame image as a multi-page PDF using im.savefp, "PDF", saveall=True. The function computes the next PDF object ID by calling m...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via linearizepagetree in src/PIL/PdfParser.py, where a PDF file containing a deeply nested page tree causes unbounded recursion that exhausts the call stack. An attacker can supply a malicious PDF with an...