Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0

PdfParser's get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp= , format="PDF", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch. Details get_value() in src/PIL/PdfParser.py This is a clas…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 06:11, GitHub Advisory Database에서 "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python, GitHub. CVE: CVE-2026-112391.