CVE-2026-112406

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406

The Pillow Python imaging library (versions 5.1.0 through 13.0.0 ) contains a vulnerability where PdfParser.rewrite_pages() can enter an infinite loop . The root cause is that the function follows Parent relationships in a page tree without detecting cycles. An attacker can provide a cyclic PDF t...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...