PatchSiren cyber security CVE debrief
CVE-2026-42310 Unknown Vendor CVE debrief
CVE-2026-42310 affects Pillow, the Python imaging library, in versions 4.2.0 through before 12.2.0. According to the NVD record and the linked GitHub advisory materials, an attacker can supply a malicious PDF that causes the process to hang indefinitely and consume 100% CPU, leaving the application unresponsive. The issue is classified as CWE-835 and was fixed in Pillow 12.2.0.
- Vendor
- Unknown Vendor
- Product
- Unknown
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-09
- Original CVE updated
- 2026-05-09
- Advisory published
- 2026-05-09
- Advisory updated
- 2026-05-09
Who should care
Teams that use Pillow to open or convert PDFs, especially internet-facing services, document ingestion pipelines, preview generators, and batch jobs that process untrusted files.
Technical summary
The vulnerable code path can be driven into non-terminating behavior by a crafted PDF, resulting in a denial of service through CPU exhaustion. The supplied sources do not provide deeper root-cause details beyond the hang/infinite-loop behavior, so defensive attention should focus on versioning, input controls, and runtime limits.
Defensive priority
Medium; raise to high if untrusted PDFs are accepted from users or external sources.
Recommended defensive actions
- Upgrade Pillow to 12.2.0 or later.
- Inventory applications and containers that use Pillow for PDF handling and confirm the fixed version is deployed.
- If immediate upgrade is not possible, restrict or disable PDF ingestion from untrusted sources.
- Add execution timeouts, worker restarts, and resource limits for file-processing jobs to reduce the impact of hangs.
- Monitor for sustained CPU spikes or stuck workers in services that process PDFs.
Evidence notes
Claims are based only on the supplied NVD record and GitHub-linked project references. The advisory states the affected range is 4.2.0 to before 12.2.0 and that the fix ships in 12.2.0. The record identifies CWE-835 and describes indefinite hang/100% CPU behavior. No exploit details or additional root-cause analysis were used.
Official resources
Publicly disclosed via the NVD entry and GitHub security-advisory materials on 2026-05-09. The supplied sources do not indicate a separate embargo date.