Zero Day MonitorZDM

← Back to list

—

CVE-2026-112894PATCHED

python software foundation · pillow

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

Description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

Affected Products

Vendor	Product	Versions
python software foundation	pillow	pip/Pillow: >= 5.1.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm(x_refsource_CONFIRM)
https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb(x_refsource_MISC)
https://github.com/python-pillow/Pillow/releases/tag/13.0.0(x_refsource_MISC)

Related News (2 articles)

Tier C

oss-security2d ago

Pillow 13.0.0 fixes long list of vulnerabilities

→ No new info (linked only)

Tier C

VulDB4d ago

CVE-2026-112894 | python-pillow Pillow up to 12.x Pdf Parser PdfParser.next_object_id resource consumption

→ No new info (linked only)

Discussion (0)

Loading…

CISA KEV❌ No

Actively exploited❌ No

Patch available

Pillow@13.0.0

CWECWE-407

PublishedOct 19, 2026

Last enriched4d agov2

Trending Score42

Source articles2

Independent2

Info Completeness8/14

Missing: cvss, epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-112390

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

MEDIUMCVE-2026-112899

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

NONECVE-2026-96643

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

HIGHCVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler size

HIGHCVE-2026-112902

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 19, 2026

Discovered by ZDM

Oct 19, 2026

Updated: severity, patchAvailable

Oct 19, 2026

Patch Available

Oct 20, 2026

Version History

v2

Last enriched 4d ago

v2Tier C4d ago

Updated severity from NONE to MEDIUM and confirmed patch available in version 13.0.0

severitypatchAvailable

via VulDB

v14d ago

Initial creation