CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

High 8.7 Published 19 Oct 2026 Updated 20 Oct 2026

An attacker can cause excessive CPU consumption and denial of service by supplying a crafted multi-frame image to applications using Pillow for PDF conversion.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-112894?

CVE-2026-112894 is a high-severity denial of service vulnerability in Python Pillow, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

Weakness: CWE-407

Which versions are affected by CVE-2026-112894?

3 open source packages ship an affected version, including pillow and Pillow. It affects 1 product.

Package	Affected	Fixed in
`pillow` Bitnami	From `5.1.0`	`13.0.0`
`pillow` PyPI	From `5.1.0`	`13.0.0`
`Pillow` PyPI	From `5.1.0`	`13.0.0`

Products include Python Pillow.

How do I fix CVE-2026-112894?

Upgrade pillow to 13.0.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-112894 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112894 exists.

All Python Pillow vulnerabilities

Sources

Also known as BIT-pillow-2026-112894, DEBIAN-CVE-2026-112894, ECHO-54bd-4ebb-6978, GHSA-jg86-v3jv-hrpm, ROOT-APP-PYPI-CVE-2026-112894, UBUNTU-CVE-2026-112894.