CVE-2026-42310 Details
Description
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
A denial-of-service vulnerability has been identified in the Pillow Python imaging library, specifically in versions 4.2.0 prior to 12.2.0. The issue arises when the PdfParser component processes malicious PDF files. The parser follows Prev pointers in PDF trailers to read cross-reference sections, but if a trailer's Prev pointer creates a loop by referencing an already processed offset, the parser can enter an infinite loop. This loop causes the application to become unresponsive, consuming 100% CPU. The vulnerability has been patched in Pillow version 12.2.0.
Users can upgrade to Pillow version 12.2.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468 | [email protected] | Patch |
| https://github.com/python-pillow/Pillow/pull/9519 | [email protected] | Issue TrackingPatch |
| https://github.com/python-pillow/Pillow/releases/tag/12.2.0 | [email protected] | ProductRelease Notes |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python pillow | >= 4.2.0, < 12.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | New CVE Received | [email protected] |