CVE-2026-112391: 
Python vulnerability analysis and mitigation

CVE-2026-112391 is a denial-of-service vulnerability in Pillow's PdfParser.get_value() function caused by an ineffective recursion-depth guard when parsing nested PDF objects. Affecting Pillow versions 5.1.0 through 12.3.0 (fixed in 13.0.0), the flaw allows an unauthenticated attacker to crash a worker process by supplying a deeply nested PDF to any application that saves images with PDF append mode enabled. It was published on October 19, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an ineffective recursion-depth guard in PdfParser.get_value() in src/PIL/PdfParser.py (CWE-835: Loop with Unreachable Exit Condition; CWE-770: Allocation of Resources Without Limits or Throttling). The function accepts a max_nesting: int = -1 parameter and checks if max_nesting == 0: return None, None, but every recursive call decrements the value further into negative integers (-1, -2, -3, …), so the guard condition == 0 is never satisfied. The parser follows attacker-controlled arrays, dictionaries, and indirect object definitions without any effective depth limit, meaning a PDF with objects nested a few thousand levels deep (achievable in a file of only a few hundred bytes) will exhaust Python's call stack. Exploitation requires the target application to call Image.save(..., format="PDF", append=True) against an attacker-supplied PDF file; Image.open() does not reach PdfParser (GitHub Advisory, Fix Commit).

Successful exploitation causes an uncaught RecursionError that terminates the worker process handling the PDF operation, resulting in a denial-of-service condition. There is no confidentiality or integrity impact — Pillow's PDF parser is only reachable through the append-mode save path, so only applications performing PDF stamping, watermarking, or similar append workflows are at risk. Affected services may experience request failures or process crashes for the duration of the attack, but no data exfiltration or code execution is possible (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a specific application precondition — the target must use Image.save() with append=True against attacker-supplied PDF content — which limits the attack surface (GitHub Advisory).

1. Identify a target application: Locate a web service or application that accepts user-supplied PDF files and subsequently calls Image.save(..., format="PDF", append=True) using Pillow 5.1.0–12.3.0 (e.g., a PDF stamping or watermarking service).
2. Craft a malicious PDF: Construct a minimal valid PDF containing a deeply nested array or dictionary object (e.g., 3,000 levels of [ brackets) embedded in the /Root catalog entry. This can be done in plain Python without any PDF library, as demonstrated in the advisory's proof-of-concept code.
3. Submit the malicious PDF: Upload or supply the crafted PDF to the target application through whatever input mechanism it exposes (file upload, API endpoint, etc.).
4. Trigger the parse: When the application opens the attacker-supplied PDF for append and calls PdfParser.get_value(), the function recurses without limit through the nested objects, exhausting Python's call stack.
5. Achieve denial of service: The worker process raises an uncaught RecursionError and terminates, causing the request to fail and potentially taking down the worker for subsequent requests (GitHub Advisory).

• Logs: Application error logs showing unhandled RecursionError: maximum recursion depth exceeded originating from src/PIL/PdfParser.py in the get_value() call stack.
• Process: Unexpected termination or restart of worker processes (e.g., Gunicorn, uWSGI, Celery workers) coinciding with PDF processing requests.
• Network: Repeated upload requests delivering small PDF files (a few hundred bytes) to endpoints that trigger PDF append operations, particularly if followed by HTTP 500 errors or worker restarts.
• File System: Presence of small, syntactically unusual PDF files with deeply nested array or dictionary structures (e.g., thousands of consecutive [ or << tokens) in upload directories or temporary storage (GitHub Advisory).

Upgrade Pillow to version 13.0.0 or later, which fixes the issue by changing the default max_nesting parameter in both get_value() and read_indirect() from -1 to 900, ensuring the recursion guard is reachable (Fix Commit, Pillow 13.0.0). If immediate patching is not possible, restrict PDF append processing to trusted, internally generated PDF sources only, and disable the append=True save path where not strictly required. Additionally, implementing process-level resource limits (e.g., ulimit -s for stack size, or per-request timeouts) can reduce the impact of a successful attack.

The vulnerability was reported by security researcher 0xSmiley and published as GitHub Security Advisory GHSA-254f-3936-288h on October 17, 2026. The advisory notes this is the same class of bug as the previously fixed GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop), but in a different function that the earlier fix did not address. Red Hat tracked the issue via Bugzilla and assigned it a Medium severity rating under their CVSS v3.1 assessment (GitHub Advisory, Red Hat CVE).