Pillow PDF flaw causes denial of service in Python applications

A high-severity vulnerability in the Python imaging library Pillow allows attackers to trigger denial of service conditions. The issue arises when applications process specific PDF files during append operations.

What happened

The National Vulnerability Database records CVE-2026-112895 as a high-severity flaw, assigning it a CVSS score of 8.7. The vulnerability exists in Pillow versions ranging from 5.1.0 up to, but not including, 13.0.0. According to the advisory, the defect stems from how the PdfParser handles page-tree structures within PDF documents. The parser follows child references without tracking cycles or duplications effectively. It also relies on a limited guard for previous-trailer chains.

This lack of robust validation allows deep or cyclic page trees to exhaust the Python stack. Long chains of unique trailer offsets can similarly overwhelm system resources. Repeated non-cyclic references to child nodes can cause super-linear increases in CPU and memory usage. An attacker can exploit this by supplying a crafted PDF to an application that uses Image.save with PDF append functionality enabled. The result is an uncaught RecursionError or significant resource consumption before output is written. This leads to a denial of service for the affected application.

Why it matters

Organisations using Python for image processing or document handling are directly exposed to this risk. The wide version range means many legacy and current deployments are vulnerable. The flaw does not require remote code execution privileges; it merely requires the application to process a malicious file. Since Pillow is a widely used library, the attack surface is extensive.

Any service that accepts user-uploaded PDFs for appending or manipulation is a potential target. The severity rating of 8.7 reflects the ease of exploitation and the impact on availability. Teams must treat this as a critical operational risk if they cannot immediately patch. The absence of complex exploitation requirements lowers the barrier for attackers.

What happens next

• Identify all systems running Pillow versions below 13.0.0.
• Test the upgrade to version 13.0.0 in a non-production environment.
• Apply the update to production systems after verification.
• Monitor application logs for RecursionError spikes during the transition.
• Review input validation for any PDF processing endpoints.

Patch priority

Security teams usually prioritise systems that face external users or accept untrusted file uploads. Check whether your infrastructure exposes PDF processing endpoints to the internet. Roll out updates to these high-exposure assets first to reduce the attack surface. Verify that the new version functions correctly with your existing workflows before wider deployment.

Back up configuration files and application states prior to making changes. If immediate patching is not possible, consider restricting input types or disabling append features temporarily. Monitor resource usage closely for signs of exploitation attempts. Coordinate with development teams to ensure compatibility with the updated library.

Background: Remote code execution vulnerabilities

Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.

Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution

What to do and how to stay safe: Pillow

• Scan your inventory for Pillow installations older than version 13.0.0.
• Verify that applications handling PDFs implement strict input validation.
• Monitor server resources for unusual spikes in CPU or memory usage.
• Prepare an emergency update plan for critical systems once the vendor provides an update.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are affected by CVE-2026-112895?

Versions from 5.1.0 up to, but not including, 13.0.0 are affected.

Is there a fix available for this vulnerability?

Yes, the issue is fixed in version 13.0.0.

What type of attack does this vulnerability enable?

It enables denial of service through resource exhaustion or RecursionError.