CVE-2026-112894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-112894
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb Patch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit Patch Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
History

27 Oct 2026, 14:56

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Python
Python pillow
References () https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb - () https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb - Patch
References () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - Release Notes
References () https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm - () https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm - Exploit, Patch, Vendor Advisory
CPE cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

20 Oct 2026, 15:17

Type Values Removed Values Added
References () https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm - () https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm -

19 Oct 2026, 22:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-19 22:17

Updated : 2026-10-27 14:56

NVD link : CVE-2026-112894

Mitre link : CVE-2026-112894

CVE.ORG link : CVE-2026-112894

JSON object : View

Products Affected

python

  • pillow
CWE
CWE-407

Inefficient Algorithmic Complexity