CVE-2026-96640: CWE-400: Uncontrolled Resource Consumption in python-pillow Pillow

Pillow, a Python imaging library, contains a vulnerability (CVE-2026-96640) in the PdfParser.linearize_page_tree() function from versions 5.1.0 up to but not including 13.0.0. The function incorrectly treats the PDF /Pages graph as a tree without detecting duplicate indirect references. When Image.save(..., format="PDF", append=True) processes a crafted PDF with /Kids arrays repeatedly referencing the same child /Pages node, the shared subtree is expanded multiple times as distinct pages. This causes exponential growth in page references and results in disproportionate CPU consumption before the append operation completes. This is a denial-of-service type vulnerability categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-407. The vulnerability has a CVSS 4.0 score of 8.2 (high severity).

An attacker can supply a specially crafted PDF file that causes Pillow to consume excessive CPU resources during PDF append operations, potentially leading to denial of service or degraded performance of applications using Pillow for PDF processing. There is no indication of privilege escalation or data disclosure. No known exploits in the wild have been reported.

This vulnerability is fixed in Pillow version 13.0.0. Users should upgrade to version 13.0.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.