Pillow CVE-2026-112894

Exploitation requires a consuming application that uses Pillow's Image.save with save_all=True to convert attacker-supplied multi-frame images (e.g. APNG, GIF, TIFF) into a multipage PDF; the quadratic cost scales with the declared/processed frame count, so a small APNG with a large declared frame count is sufficient. Limiting factors: the vulnerable PDF object-ID path is only reached during multi-frame PDF saving - applications that do not perform image-to-PDF conversion, that disable save_all, or that cap/validate frame counts or input size before conversion are not exposed. No authentication is required of the attacker per the CVSS (PR:N), but reachability depends entirely on the host application accepting untrusted images into this conversion workflow. Affected Pillow versions are 5.1.0 through 12.x; 13.0.0 contains the fix.

This is a denial-of-service flaw (CWE-407, inefficient algorithmic complexity) where PdfParser.next_object_id() runs in quadratic time, confirmed by the vendor GHSA-jg86-v3jv-hrpm advisory and the source commit f6a852555f which caches a _max_object_id instead of rescanning all reserved identifiers. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and reflects a network-reachable, unauthenticated, low-complexity trigger with impact confined to availability (VA:H; VC:N/VI:N/VA:H - no confidentiality or integrity impact). Signals are consistent in direction but modest in real priority: there is NO EPSS score in the input, the CVE is NOT on CISA KEV, and no public exploit or POC is referenced, so there is no evidence of active or widespread exploitation. The high score is driven entirely by easy reachability, not by severe impact - this is a resource-exhaustion DoS, not RCE or data exposure. A meaningful caveat: the CVSS claims PR:N/AV:N, but exploitation is NOT against Pillow in isolation - it requires a downstream application that feeds attacker-supplied multi-frame images into Pillow's save_all PDF conversion path, so the network/unauthenticated rating depends on that application's exposure rather than Pillow itself.

An attacker uploads a crafted multi-frame image - for example a small APNG that declares a very large frame count - to a web application that uses Pillow to convert user images into multipage PDFs with save_all enabled. During conversion, PdfParser reserves object identifiers in quadratic time, pinning a CPU core and stalling or exhausting the worker, degrading or denying service for other users. No public POC is referenced in the available data, and the low attack complexity means a single small file can trigger disproportionate CPU cost.