PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42310 python-pillow CVE debrief

CVE-2026-42310 affects Pillow, the Python imaging library, in versions 4.2.0 through before 12.2.0. According to the NVD record and the linked GitHub advisory materials, an attacker can supply a malicious PDF that causes the process to hang indefinitely and consume 100% CPU, leaving the application unresponsive. The issue is classified as CWE-835 and was fixed in Pillow 12.2.0.

Vendor
python-pillow
Product
Pillow
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Teams that use Pillow to open or convert PDFs, especially internet-facing services, document ingestion pipelines, preview generators, and batch jobs that process untrusted files.

Technical summary

The vulnerable code path can be driven into non-terminating behavior by a crafted PDF, resulting in a denial of service through CPU exhaustion. The supplied sources do not provide deeper root-cause details beyond the hang/infinite-loop behavior, so defensive attention should focus on versioning, input controls, and runtime limits.

Defensive priority

Medium; raise to high if untrusted PDFs are accepted from users or external sources.

Recommended defensive actions

  • Upgrade Pillow to 12.2.0 or later.
  • Inventory applications and containers that use Pillow for PDF handling and confirm the fixed version is deployed.
  • If immediate upgrade is not possible, restrict or disable PDF ingestion from untrusted sources.
  • Add execution timeouts, worker restarts, and resource limits for file-processing jobs to reduce the impact of hangs.
  • Monitor for sustained CPU spikes or stuck workers in services that process PDFs.

Evidence notes

Claims are based only on the supplied NVD record and GitHub-linked project references. The advisory states the affected range is 4.2.0 to before 12.2.0 and that the fix ships in 12.2.0. The record identifies CWE-835 and describes indefinite hang/100% CPU behavior. No exploit details or additional root-cause analysis were used.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42310 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42310

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42310 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42310

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.