CVE-2026-96640

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the application to process an exponential number of pages. This can consume excessive CPU resources, resulting in a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having an Important severity rating because remote, unauthenticated attackers can cause severe application denial of service through exponential CPU exhaustion. Although Pillow is widely distributed across Red Hat products and container images, exploitation is constrained to environments that accept untrusted PDF files and append image content to them. Standard image processing pipelines and read operations remain unaffected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.