CVE-2026-112391: Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

October 21, 2026

PdfParser’s get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp=<pdf>, format="PDF", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch.

References

github.com/advisories/GHSA-254f-3936-288h
github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd
github.com/python-pillow/Pillow/releases/tag/13.0.0
github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h
nvd.nist.gov/vuln/detail/CVE-2026-112391

Code Behaviors & Features

Detect and mitigate CVE-2026-112391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →