CVE-2026-96640
HIGH(7.5)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 7.5 — Hoch
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.6%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.5
Technische Schwere
Beschreibung
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.
Betroffene Produkte
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
GitHub Advisories
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Referenzen
- https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622...
- https://github.com/python-pillow/Pillow/pull/10093
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2