CVE-2026-96640

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

PT-2026-120834

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize page tree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...