{"cve":"CVE-2026-112895","nvd":{"published":"2026-10-19T22:17:09.620","modified":"2026-10-20T19:50:26.943","status":"Undergoing Analysis","description":"Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-674"],"references":["https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf","https://github.com/python-pillow/Pillow/releases/tag/13.0.0","https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-112895","score":0.00417,"percentile":0.35772,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-p4wg-p73j-c528","url":"https://osv.dev/vulnerability/GHSA-p4wg-p73j-c528","summary":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","modified":"2026-10-26T08:55:38.434240536Z","packages":[{"ecosystem":"PyPI","name":"pillow","purl":"pkg:pypi/pillow","ranges":[">=5.1.0 <13.0.0"],"fixed":["13.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}