CVE-2026-96640: Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Pillow versions 5.1.0 through 12.x are exposed when they append to an attacker-controlled existing PDF with Image.save(..., format="PDF", append=True). Processing ordinary PDFs or creating a PDF without appending to an existing file is not described as affected.
What must an attacker provide to trigger the resource exhaustion?
The attacker needs to supply an existing malformed PDF whose /Pages /Kids arrays repeatedly reference the same child /Pages node. This shared page-tree DAG causes Pillow to expand the same subtree repeatedly while processing the append operation.
What is the impact during exploitation?
A compact malicious PDF can cause exponentially many page references to be expanded, resulting in disproportionate CPU consumption before the append operation completes.
What remediation is available?
Upgrade Pillow to version 13.0.0, which fixes the issue.