Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 8
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-27 14:56
- StatusPublished → AnalyzedNVD modified 2026-10-27 14:56
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-20 14:46
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:50
- StatusReceived → PublishedNVD modified 2026-10-20 14:46
- StatusPublished → ReceivedNVD modified 2026-10-20 15:17
- StatusReceived → PublishedNVD modified 2026-10-19 21:55
- First seenCVSS 8.7NVD modified 2026-10-19 22:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit, Patch, Vendor Advisory