## Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-112895
- 公開日時: 2026-10-20T20:50:49.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-p4wg-p73j-c528)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-p4wg-p73j-c528

影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0
Summary When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…