EUVD-2026-104601
GHSA-254f-3936-288h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app using Pillow PDF append on untrusted input
-
DeliverySubmit deeply nested malicious PDF
-
ExploitTrigger unbounded recursion in PdfParser.get_value
-
ExecutionUncaught RecursionError crashes worker
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to save an image using Pillow's PDF append mode (opening an existing PDF for append) where that existing PDF is attacker-controlled or attacker-influenced; the malicious input is a deeply nested PDF object graph (nested arrays/dictionaries) that drives PdfParser.get_value()/read_indirect() past the recursion limit. Limiting factors: the vulnerable path is NOT reached by default image operations - the application must explicitly use PDF append on untrusted input, and impact is confined to a crash/worker termination (availability only) with no RCE, data exposure, or integrity impact. Affected versions are Pillow 5.1.0 up to (not including) 13.0.0. |
| Impact | This is a genuine but modest-priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium) with impact limited strictly to availability (VA:L; VC:N/VI:N) - consistent with CWE-835 unbounded recursion causing a RecursionError or worker termination. There is no confidentiality or integrity impact and no code execution. No EPSS score, KEV listing, or SSVC decision data was supplied, and no standalone public exploit was referenced - the only 'exploit' signal is a published fix (GHSA-254f-3936-288h plus commit 94cb11c and the 13.0.0 release) that includes a regression test demonstrating the crash pattern, which is a proof of the bug rather than a weaponized exploit. The AT:P ('attack requirement present') metric is the key moderating signal: exploitation is only possible when the consuming application saves an image with PDF append enabled against an attacker-influenced existing PDF, so this is not a drive-by condition despite the AV:N network vector. Net: a real, low-privilege, network-reachable DoS gated by a specific application configuration - patch on a normal cycle, prioritize only if you knowingly run Pillow PDF append on untrusted input. |
| Exploit ScenarioDerived | An application uses Pillow to append a new page/image to an existing PDF (PDF append mode) where the base PDF is supplied or influenced by an untrusted user. The attacker submits a PDF containing deeply nested arrays/dictionaries (e.g., ~1000 levels of '[' ... ']'); when PdfParser.get_value()/read_indirect() recurses without a limit, the worker raises an uncaught RecursionError and crashes, denying service. No public exploit is identified, but the fix's regression test shows the exact crafted-input pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Unbounded recursion in Pillow's PDF parser (versions 5.1.0 through 12.x) can crash a Python worker when an application opens an attacker-supplied PDF for append, producing availability-only denial of service. The issue is reachable only when the application explicitly uses Pillow's PDF append mode on untrusted input; the independent assessment rates it as a modest-priority availability issue, not a top-tier emergency, and no public exploit has been identified at time of analysis. Pillow 13.0.0 fixes the problem by capping parser nesting depth.
RemediationAI
Vendor-released patch: upgrade to Pillow 13.0.0, which caps parser nesting depth at 900 by default. The fix commit is https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd and the advisory is https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h. If immediate upgrade is not possible, do not enable PDF append mode when processing untrusted PDFs; validate or reject PDFs with excessive object nesting before passing them to Pillow; and run conversion workers in isolated processes with recursion, memory, and timeout limits so a RecursionError terminates only the sandboxed worker. Trade-offs: disabling append removes legitimate PDF-append workflows, input validation may reject complex but valid PDFs, and process isolation adds operational overhead while limiting the blast radius of a crash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pillow is a widely used Python imaging library. Its PdfParser reads PDF object graphs, and PdfParser.get_value() recursively follows arrays and dictionaries. In affected versions, get_value() and read_indirect() defaulted max_nesting to -1, effectively disabling the recursion-depth guard; a deeply nested PDF object graph can therefore drive the parser past Python's recursion limit and raise an uncaught RecursionError. The commit changes both defaults to 900 and adds a regression test using 1,000 nested arrays. This maps to CWE-835, a loop or recursive path with no effective exit condition, but the practical impact here is availability only: no code execution, data disclosure, or integrity impact. The vulnerable path is not reached by ordinary image operations; it requires an application to open an existing, attacker-controlled PDF for append. The supplied CPE identifies python-pillow:pillow broadly, while the vendor advisory narrows the affected range to 5.1.0 through versions before 13.0.0.
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Attacker-supplied PDF is processed over the network path with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a worker-crash DoS only (A:L, C/I:N), gated application-side by PDF-append mode.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.
Blast Radius
ecosystem impact- 21 pypi packages depend on pillow (15 direct, 6 indirect)
Ecosystem-wide dependent count for version 5.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
Exploit-DB