Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112406
``` ============================================================================ Infinite loop in PdfParser.rewrite_page
#pip
共收录 834 条相关情报。
← 返回所有主题Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-112399
``` ============================================================================ APNG background disposal allocates full
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
CVE-2026-112892
### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112894
``` ============================================================================ Quadratic-time DoS in PDF save_all (Pdf
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
CVE-2026-112391
### Summary `PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
CVE-2026-112901
``` ============================================================================ ReDoS in XbmImagePlugin: 512-byte file
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
CVE-2026-112898
``` ============================================================================ Image.quantize() with empty palette lea
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
CVE-2026-112401
``` ============================================================================ Quadratic GIF comment concatenation all
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112390
``` ============================================================================ Infinite loop in MIC n_frames when the
Pillow: Quadratic GIF comment copying during save
CVE-2026-112891
On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112392
``` ============================================================================ NULL dereference in ImagingExpand via r
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE-2026-112405
### Summary `Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` ima
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
CVE-2026-112893
### Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-112402
``` ============================================================================ Double free in ImagingScaleAffine on ca
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112394
### Summary On `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the en
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112900
### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`)
pypdf: Unvalidated JPEG image data loading
CVE-2026-113786
### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called.
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-112397
### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passi
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112400
``` ============================================================================ GIF seek keeps rejected size after Deco
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
CVE-2026-112899
``` ============================================================================ EPS load(scale) lets Ghostscript render