CVE-2026-112894: Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall enabled. PdfParser.nextobjectid() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications using Pillow to convert untrusted multi-frame images into multipage PDFs with save_all enabled are exposed. An attacker can provide a multi-frame image, including a small APNG that declares a large number of frames, to drive excessive CPU consumption.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction; the vulnerable application must process attacker-supplied input through the affected PDF conversion path.
Which Pillow versions are affected, and what version fixes the issue?
Pillow versions from 5.1.0 up to, but not including, 13.0.0 are affected. The issue is fixed in Pillow 13.0.0.