{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pillow--5.1.0--13.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112895"},{"cvss":5.5,"id":"CVE-2026-42310"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pillow (\u003e= 5.1.0, \u003c 13.0.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","python","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003ePillow, a popular Python imaging library, contains vulnerabilities that allow an attacker to trigger unbounded recursion during the parsing of malformed PDF files. When an application utilizes \u003ccode\u003eImage.save\u003c/code\u003e with \u003ccode\u003eappend=True\u003c/code\u003e, the library invokes \u003ccode\u003ePdfParser\u003c/code\u003e to process the existing PDF structure. Two specific areas of the parser lack necessary bounds: \u003ccode\u003elinearize_page_tree\u003c/code\u003e follows \u003ccode\u003e/Kids\u003c/code\u003e entries without tracking visited nodes or enforcing a depth limit, and \u003ccode\u003eread_prev_trailer\u003c/code\u003e permits long chains of unique \u003ccode\u003e/Prev\u003c/code\u003e offsets.\u003c/p\u003e\n\u003cp\u003eThese vulnerabilities serve as an incomplete fix for CVE-2026-42310. An attacker can craft malicious PDF files containing cyclic page trees or extensively deep \u003ccode\u003e/Prev\u003c/code\u003e chains to drive the parsing process into high CPU and memory utilization, leading to application crashes or denial of service. The vulnerability affects all Pillow versions from 5.1.0 up to, but not including, 13.0.0. Defenders should note this impacts any service that processes user-supplied PDFs for operations such as stamping, watermarking, or merging.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploit causes denial of service by exhausting stack space, CPU, and memory resources. Any service performing automated processing of user-provided PDFs - common in document management, e-signature, or image processing pipelines - is susceptible. The impact is significant for services where availability is critical and where the processing component shares memory or CPU resources with other application functions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Pillow library to version 13.0.0 or later immediately to address CVE-2026-112895.\u003c/li\u003e\n\u003cli\u003eAudit application code to identify endpoints that invoke \u003ccode\u003eImage.save(..., format=\u0026quot;PDF\u0026quot;, append=True)\u003c/code\u003e on untrusted user input.\u003c/li\u003e\n\u003cli\u003eImplement input validation or limit file sizes and complexity for incoming PDF documents before passing them to the Pillow library.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement a file-parsing timeout for any process handling PDF manipulation to mitigate the impact of CPU and memory exhaustion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:53:38Z","date_published":"2026-10-20T23:53:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pillow-pdf-recursion/","summary":"Pillow is vulnerable to denial of service through unbounded recursion when parsing malformed PDF files using Image.save with append=True due to insufficient depth checks in page tree and trailer chain traversals.","title":"Pillow: PDF unbounded recursion in page tree and trailer parsing (CVE-2026-112895)","url":"https://feed.craftedsignal.io/briefs/2026-10-pillow-pdf-recursion/"}],"language":"en","title":"CraftedSignal Threat Feed - Pillow (\u003e= 5.1.0, \u003c 13.0.0)","version":"https://jsonfeed.org/version/1.1"}