CVE-2026-112406

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.

• CWE-835

• https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112400Pillow is a Python imaging library. From 9.2.0 until 13.0.0,…8.7
• CVE-2026-112401Pillow is a Python imaging library. From 5.4.0 until 13.0.0,…6.9
• CVE-2026-112402Pillow is a Python imaging library. Prior to 13.0.0, Pillow …8.7
• CVE-2026-112403Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…9.2
• CVE-2026-112404Pillow is a Python imaging library. From 8.1.0 until 13.0.0,…8.8
• CVE-2026-112405Pillow is a Python imaging library. From 12.0.0 until 13.0.0…8.7
• CVE-2026-112407Incorrect privilege assignment in the IAM policy of AWS CICD…8.8
• CVE-2026-112408Missing verification of source of a communication channel in…8.1
• CVE-2026-11241Insufficient validation of untrusted input in Cast in Google…8
• CVE-2026-11242Insufficient validation of untrusted input in Plugins in Goo…7.5
• CVE-2026-11243Inappropriate implementation in Downloads in Google Chrome p…5.4
• CVE-2026-11244Insufficient validation of untrusted input in WebAuthenticat…3.1