Security fix · CVE-2026-96640

Pillow is a Python imaging library.

Q: Which versions are affected?

Compare what you have installed with Pillow >= 5.1.0, < 13.0.0. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-407; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.60%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 21, 2026 · catalog updated Oct 28, 2026 · Pillow is a Python

Last checked Oct 30, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-96640. EPSS is 0.60%. Act only if a listed version of Pillow is a Python is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (Pillow is a Python).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

CVE-2026-96641 · Medium
CVE-2026-96778 · High
CVE-2026-42311 · High
CVE-2026-42310 · Medium
CVE-2026-42309 · Medium

Severity: High8.2
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.60%
Remediation: Version ranges on file
Affected products: Debian:12 pillow · Debian:13 pillow · Debian:14 pillow · cpe python/pillow · package pip · pip Pillow

### Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with can provide a malformed tree where each level repeats the same child reference in . Pillow treats the graph as a tree and expands each repeated reference in without tracking visited or duplicate indirect references. In the bounded proof below, a -byte PDF expands to page references from one distinct page object and takes about seconds through the append path. A comparable linear control with the same depth stays at one page reference and completes in about seconds. This is in scope for Pillow's security policy because it is reproducible in , affects the latest public release tested ( ), and is not just an unexpected Python exception. The vulnerable operation accepts attacker-controlled PDF bytes through Pillow's PDF parser and causes deterministic resource consumption before normal completion. ### Details #### Affected versions - Package: - Ecosystem: / PyPI - Affected component: page-tree traversal reached from PDF append handling - Runtime-tested affected release: - Runtime-tested affected development version: - Tested commit: - Current source artifact hash: - Release commit: - Release source artifact hash: - Source-level affected: , , , and - Likely affected range: - Patched versions: none known Evidence fact strings: - Runtime-tested affected: 12.3.0 - Runtime-tested affected: 13.0.0.dev0 at b39b9649312fbc381060e8c7c7f9f0de4cc63daa - Source-level affected: 5.1.0 - Source-level affected: 12.2.0 - Source-level affected: HEAD - Likely affected range: >= 5.1.0, no fixed version known - Pre-boundary note: 5.0.0 has PdfImagePlugin.py but no src/PIL/PdfParser.py contains but does not contain . was introduced by ( ), which shipped in . #### Technical details The reachable path is: 1. A service or application receives an attacker-influenced existing PDF and appends

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Debian:12 pillow10.0.0-1, 10.1.0-1, 10.2.0-1
Debian:13 pillow11.1.0-5, 11.1.0-5+deb13u1, 11.1.0-5+deb13u2
Debian:14 pillow11.1.0-5, 11.2.1-1, 11.3.0-1
cpe python/pillow< 13.0.0
package pipversion unspecified
pip Pillow>= 5.1.0, < 13.0.0
pypi pillowversion unspecified

How to fix CVE-2026-96640

Upgrade
CVE-2026-96640 lists a fix boundary at 13.0.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 13.0.0
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96640. EPSS is 0.60%. Act only if a listed version of Pillow is a Python is installed.

Which versions are affected?

Compare what you have installed with Pillow >= 5.1.0, < 13.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-407; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.60%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security Pillow security

Code

The project this record applies to. Exploit listings stay in References.

Repository · github.com

Timeline

Detection, updates, and resolution for this record.

Oct 21, 2026 · NIST NVD
Detected
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as
Oct 22, 2026 · GitHub Advisory Database
Updated
### Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with can provide a malformed tree where each level repeats the same child reference in . Pillow treats the graph as a tree and expands each repeated reference in without tracking visited or dupli
Oct 28, 2026 · NIST NVD
Updated
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as
Oct 28, 2026 · OpenSSF OSV / OSV Scanner
Updated
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as

Sources

CVE.orgVulnerability recordCVE-2026-96640
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-96640
30-day exploitation probability 0.60%
first.org
GitHub Advisory DatabasePackage advisoryGHSA-mrfp-p49p-3hf2
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-96640
Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save(…, format="PDF", append=True) can provide a malformed /Pages tree where each level repeats the same child /Pages reference in /Kids. Pillow treats the graph as a tree and expands each
advisories.gitlab.com
NIST NVDVulnerability recordCVE-2026-96640
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlle
nvd.nist.gov
OpenCVEVendor advisoryCVE-2026-96640
CVE-2026-96640 is named on the public OpenCVE page.
opencve.io
OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-96640
osv.dev
Red Hat Security DataVendor advisoryCVE-2026-96640
pillow: pillow: Denial of Service via duplicate page references in PDF files
access.redhat.com
Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-PILLOW-21431018
Allocation of Resources Without Limits or Throttling
security.snyk.io

References

Freshness

Last verified in this catalog Oct 30, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSOct 30, 2026
OpenSSF OSV / OSV ScannerOct 28, 2026
NIST NVDOct 28, 2026
OpenCVEOct 28, 2026
Snyk Vulnerability DatabaseOct 24, 2026
GitLab Advisory DatabaseOct 23, 2026
GitHub Advisory DatabaseOct 23, 2026
Red Hat Security DataOct 23, 2026
CVE.orgOct 22, 2026

Priority score

24/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity12/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
8.2 v4.0
Technical impact. Separate from exploitation likelihood.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
EPSS probability
0.60% · p48.88%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Debian Debian 12 Debian 13 Debian 14 Linux Pillow PyPI Python Red Hat

Weakness

CWE-400
Uncontrolled Resource Consumption
MITRE definition
CWE-407 MITRE definition
CWE-770
Allocation of Resources Without Limits or Throttling
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.