Fluid Attacks Database

Description

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	pillow	=11.1.0-5 \|\| =11.2.1-1 \|\| =11.3.0-1 \|\| =12.0.0-1 \|\| =12.1.0-1 \|\| =12.1.1-1 \|\| =12.1.1-2 \|\| >=0 <12.2.0-1	12.2.0-1
pypi	pillow	>=4.2.0 <12.2.0	12.2.0
debian 13	pillow	=11.1.0-5 \|\| =11.1.0-5+deb13u1 \|\| =11.1.0-5+deb13u2 \|\| >=0 <11.1.0-5+deb13u3	11.1.0-5+deb13u3
debian 12	pillow	=10.0.0-1 \|\| =10.1.0-1 \|\| =10.2.0-1 \|\| =10.3.0-1 \|\| =10.3.0-2 \|\| =10.4.0-1 \|\| =10.4.0-1.1 \|\| =11.1.0-1 \|\| =11.1.0-2 \|\| =11.1.0-3 \|\| =11.1.0-4 \|\| =11.1.0-5 \|\| =11.2.1-1 \|\| =11.3.0-1 \|\| =12.0.0-1 \|\| =12.1.0-1 \|\| =12.1.1-1 \|\| =12.1.1-2 \|\| =12.2.0-1 \|\| =12.3.0-1 \|\| =9.4.0-1.1 \|\| =9.4.0-1.1+deb12u1 \|\| =9.5.0-1	-

Aliases

1. CVE-2026-423102. NVD-2026-423103. OSV-DEBIAN-2026-423104. OSV-2026-423105. GHSA-r73j-pqj5-w3x76. GCVE-2026-423107. SECURITY-TRACKER-CVE-2026-42310

References

1. https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x72. https://github.com/python-pillow/Pillow/pull/95193. https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c4684. https://github.com/python-pillow/Pillow/releases/tag/12.2.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.