Denial of Service Risk in Pillow Library by Python
CVE-2026-112894
8.7HIGH
What is CVE-2026-112894?
A vulnerability in the Pillow Python imaging library affects versions from 5.1.0 to 13.0.0, allowing an attacker to exploit the PDF saving functionality. Specifically, when saving multi-frame images with the 'save_all' feature enabled, the library inefficiently reserves object identifiers, leading to excessive CPU usage. An adversary could deliver a crafted multi-frame image including a small APNG with an inflated frame count, resulting in a denial of service condition due to prolonged resource consumption. This issue was resolved in version 13.0.0 of the Pillow library.
Affected Version(s)
Pillow >= 5.1.0, < 13.0.0