CVE-2026-112894

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112894.json"
}

References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type

GIT

Repo

https://github.com/python-pillow/pillow

Events

Introduced

fda33d5c09142c4bb0e99964919d01c2cc5f5995

Fixed

293218ad059d994baf1777d882911bed6a49704a

Fixed

f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.1.0"
                },
                {
                    "fixed": "13.0.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "13.0.0",
            "range": [
                {
                    "fixed": "293218ad059d994baf1777d882911bed6a49704a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

10.*

10.0.0

10.1.0

10.2.0

10.3.0

10.4.0

11.*

11.0.0

11.1.0

11.2.1

11.3.0

12.*

12.0.0

12.1.0

12.2.0

12.3.0

5.*

5.1.0

5.2.0

5.3.0

5.4.0

6.*

6.0.0

6.1.0

6.2.0

7.*

7.0.0

7.1.0

7.2.0

8.*

8.0.0

8.1.0

8.2.0

8.3.0

8.4.0

9.*

9.0.0

9.1.0

9.2.0

9.3.0

9.4.0

9.5.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-112894.json"