CVE-2026-42310
mediumPriorität · verfolgen · 22EPSS 0.002 · 6. PerzentilDEEUFRRUUSEPSS · bewertet 2026-10-27
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.2–5.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-r73j-pqj5-w3x7Pillow has a PDF Parsing Trailer Infinite Loop (DoS)2026-05-04ghsa · osvUS
### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519
- BIT-pillow-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)2026-05-12vendor · osvUS
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
- CERTFR-2026-AVI-1366Multiples vulnérabilités dans les produits SplunkFrançais2026-10-22vendor · certfrFR
- PYSEC-2026-2874Pillow has a PDF Parsing Trailer Infinite Loop (DoS)2026-07-13vendor · osvUS
### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/python-pillow/Pillow/releases/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-42310cnnvd
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468enisa_euvd
- https://github.com/python-pillow/Pillow/pull/9519enisa_euvd
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0enisa_euvd
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7enisa_euvd
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468Patchnvd
- https://github.com/python-pillow/Pillow/pull/9519Issue TrackingPatchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan