CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Risk score: 66/100
CVSS: 8.2 v4.0
Exploit chance (30 days): 0.4%
Published: 21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Pillow's PDF append feature can be exploited to cause resource exhaustion by processing a malformed PDF with a shared page-tree DAG. An attacker could create a compact PDF that consumes disproportionate CPU before the append completes.
Affected: {'products': ['Pillow'], 'packages': ['Pillow'], 'versions': ['>= 5.1.0, < 13.0.0']}
Fix: Upgrade to version 13.0.0 or later
Exploitation: No known exploitation

Why it is Amber

CVSS 8.2 high
Remotely exploitable without logging in
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
Pillow	pip	>= 5.1.0, < 13.0.0	13.0.0

References

Original description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.

Last activity 21 Oct 2026. Patch Forecast updates every hour.