BIT-PILLOW-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

GHSA-MRFP-P49P-3HF2 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

GHSA-F2G6-542V-9J58 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640

The Pillow Python imaging library versions 5.1.0 through 13.0.0 are vulnerable to a resource exhaustion issue in the PdfParser.linearize_page_tree() function located in src/PIL/PdfParser.py . The root cause is that the parser treats a PDF /Pages graph as a tree without tracking duplicate indirect...

Allocation of Resources Without Limits or Throttling

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via linearizepagetree in src/PIL/PdfParser.py when parsing a PDF file containing a cyclic or duplicate page tree reference. An attacker ca...

CVE-2026-112406

The Pillow Python imaging library (versions 5.1.0 through 13.0.0 ) contains a vulnerability where PdfParser.rewrite_pages() can enter an infinite loop . The root cause is that the function follows Parent relationships in a page tree without detecting cycles. An attacker can provide a cyclic PDF t...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-91805

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...

CVE-2026-91805 Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...

CVE-2026-91805

Foxit PDF Editor/Reader contains a use-after-free vulnerability in its PDF page-tree handling mechanism. A specially crafted PDF can trigger page-structure changes during rendering, which causes the application to access released page objects . This vulnerability can lead to memory corruption and...

EUVD-2026-85123

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...

CVE-2026-91805 Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...

CVE-2026-91805: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...