CVE-2026-42310
mediumpriority · track · 22EPSS 0.002 · 6 %ileDEEUFRRUUSEPSS · scored 2026-10-27
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.2–5.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-r73j-pqj5-w3x7Pillow has a PDF Parsing Trailer Infinite Loop (DoS)2026-05-04ghsa · osvUS
### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519
- BIT-pillow-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)2026-05-12vendor · osvUS
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
- CERTFR-2026-AVI-1366Multiples vulnérabilités dans les produits SplunkFrançais2026-10-22vendor · certfrFR
- PYSEC-2026-2874Pillow has a PDF Parsing Trailer Infinite Loop (DoS)2026-07-13vendor · osvUS
### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519
also known as (8)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/python-pillow/Pillow/releases/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-42310cnnvd
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468enisa_euvd
- https://github.com/python-pillow/Pillow/pull/9519enisa_euvd
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0enisa_euvd
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7enisa_euvd
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468Patchnvd
- https://github.com/python-pillow/Pillow/pull/9519Issue TrackingPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan