Pillow CVE-2026-96640

Exploitation requires the target application to call Image.save(..., format="PDF", append=True) on an attacker-controlled existing PDF - i.e., the PDF-append merge workflow must be exposed to untrusted input. The malicious PDF must contain /Pages /Kids arrays that repeatedly reference the same child /Pages node so PdfParser.linearize_page_tree() expands the shared subtree into exponentially many pages. Limiting factors: this is NOT triggered by ordinary image decoding or standalone PDF export - only the append-to-existing-PDF path reads and re-linearizes the attacker's /Pages graph; impact is confined to CPU/availability (DoS) with no code execution or data disclosure; and only Pillow versions 5.1.0 through 12.x are affected (13.0.0 adds cyclic/duplicate-reference detection). Authentication requirement is unauthenticated per CVSS PR:N, but reachability depends on the application exposing this feature to attacker-supplied PDFs.

This is a resource-exhaustion denial of service (CWE-400) with no confidentiality or integrity impact, as confirmed by the CVSS 4.0 vector (VC:N/VI:N/VA:H). The headline score of 8.2 is driven almost entirely by VA:H (high availability impact) combined with AV:N/AC:L/PR:N/UI:N. Crucially, the vector carries AT:P (Attack Requirements: Present), meaning exploitation is not possible against arbitrary default usage - the target application must specifically process an attacker-controlled PDF via the PDF-append code path. No CISA KEV listing is present and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation; the exploitation probability should be treated as UNKNOWN rather than low. No standalone public exploit was identified, though the fix commit (6f0e7ee) ships a regression test that demonstrates the duplicate/cyclic-reference condition. Net assessment: the product (Pillow) is extremely widely deployed, but the vulnerable feature (Image.save append=True on untrusted PDFs) is a narrow workflow, and the worst-case outcome is CPU/availability degradation rather than compromise. This is a legitimate but conditional DoS issue - patch on normal cadence; it is not a high-CVSS-but-trivially-remote-RCE emergency. The AT:P requirement and DoS-only impact should temper the raw 8.2 when prioritizing.

An application uses Pillow's Image.save(..., format="PDF", append=True) to append image pages to an existing PDF that originates from an untrusted source (e.g., a user upload or document-merge service). An attacker submits a tiny malformed PDF whose /Kids arrays repeatedly reference the same shared /Pages node; linearize_page_tree() expands the shared subtree as if each reference were distinct, creating exponentially many page references and consuming disproportionate CPU before (or instead of) completing, stalling the worker. No public weaponized exploit was identified, but the fix commit includes a proof-style regression test demonstrating the condition. Attack vector is network/low-complexity but gated by the application exposing the PDF-append workflow.