CVE-2026-112897

Pillow prior to 13.0.0 is vulnerable to regular-expression denial of service in its XBM header parser. Calling Image.open() on a small crafted XBM file causes a backtracking expression to be applied to the attacker-controlled header, stalling a worker for minutes.

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.

In Pillow prior to 13.0.0, the TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read.

In Pillow from 5.1.0 until 13.0.0, the library can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled.

In Pillow from 5.1.0 until 13.0.0, reserving PDF object identifiers when saving many frames with save_all enabled takes quadratic time. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF.

In Pillow from 10.0.0 until 13.0.0, the library can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width.

In Pillow from 4.1.0 until 13.0.0, the MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels.

Pillow from 9.2.0 until 13.0.0 performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data, including comments from an untrusted input image, which can consume excessive CPU.

In Pillow from 5.1.0 until 13.0.0, the library can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF.

In Pillow from 12.0.0 until 13.0.0, Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band.