Cloudanix VulnDB

CVE-2026-96640

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Python library that handles images can be overwhelmed by certain specially made PDF files, causing programs that use it to slow down or become unavailable while trying to process those files.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

PdfParser.linearize_page_tree() in Pillow expands a PDF /Pages graph without tracking duplicate indirect references, allowing a compact malformed PDF to produce an exponentially large page tree and consume disproportionate CPU during Image.save(..., format="PDF", append=True).

Why it matters to the business

Applications that accept or process untrusted PDFs can experience sudden high CPU usage or service degradation when handling attacker-supplied files, increasing operational costs and availability risk for image-handling workloads.

How an attack unfolds

An attacker creates a small PDF whose /Kids arrays repeatedly reference the same child node, then supplies the file to any code path that calls Pillow's PDF append functionality; the library materializes each duplicate reference as a distinct page, exhausting CPU before the operation completes.

How to fix it

Upgrade Pillow to version 13.0.0 or later; disable PDF append functionality on untrusted inputs until the update is applied.

How to confirm the fix worked

Confirm the installed Pillow version is 13.0.0 or newer; test with a known malformed PDF sample to verify that page linearization no longer produces exponential growth.

Typical attack path

  1. Craft a compact PDF containing repeated indirect references in /Kids arrays
  2. Deliver the PDF to an application that uses Pillow to append or save images as PDF
  3. Trigger Image.save with format="PDF" and append=True on the attacker-controlled file
  4. Observe exponential page expansion and sustained high CPU consumption

How to detect it

Look for sustained high CPU during PDF append operations in application or system logs; correlate spikes with recent PDF uploads or Image.save calls involving untrusted files.

What your security team should do

  • Upgrade all Pillow installations to 13.0.0 immediately given the four-day publication window
  • Inventory code paths that call Image.save with PDF format and append=True
  • Add size or structural validation for any PDF supplied by untrusted sources
  • Monitor CPU utilization on services that process user-supplied PDFs

The record

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities