Exponential Page Reference Issue in Pillow Python Imaging Library

CVE-2026-96640

What is CVE-2026-96640?

The Pillow Python imaging library, specifically from versions 5.1.0 to 13.0.0, contains a vulnerability within the PdfParser.linearize_page_tree() method. This method erroneously treats a PDF /Pages graph as a tree structure without accurately tracking duplicate indirect references. When processing an attacker-controlled PDF with repetitive references to child /Pages nodes, an attacker can exploit the library, causing Pillow to generate an exceedingly high number of page entries. This leads to significant CPU resource consumption as the append operation processes, due to the exponential expansion of the shared subtree. This issue was addressed in version 13.0.0.

References