VDB
CVE-2026-112406
CVE-2026-112406
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 5.1.0, < 13.0.0 |
| wolfi | open-webui | 0 |
| chainguard | openstack-horizon-2025.2 | 0 |
| python-pillow | Pillow | >= 5.1.0, < 13.0.0 |
| chainguard | py3-pillow | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| chainguard | nemo-gym | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| chainguard | open-webui | 0 |
| wolfi | py3-pillow | 0 |
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 27, 2026 CVE Updated
- Oct 30, 2026 Distribution Patch
- Oct 30, 2026 Security Advisory