CVE-2026-42310
Fixed in a distro release EPSS <1%CVSS 5.1
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-pillow | 9.4.0-2.amzn2023.0.8 |
| Amazon Linux 2023 | python3-pillow-devel | 9.4.0-2.amzn2023.0.8 |
| Amazon Linux 2023 | python3-pillow-tk | 9.4.0-2.amzn2023.0.8 |
| Chainguard | kubeflow-pipelines-visualization-server | 2.16.1-r0 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | open-webui | 0.11.0-r0 |
| Chainguard | superset-6.0 | 6.0.0-r10 |
| Debian 12 | pillow | no fix |
| Debian 13 | pillow | 11.1.0-5+deb13u3 |
| Debian 14 | pillow | 12.2.0-1 |
| Ubuntu 22.04 LTS | pillow | 9.0.1-1ubuntu0.4 |
| Ubuntu 24.04 LTS | pillow | 10.2.0-1ubuntu1.2 |
| Ubuntu 25.10 | pillow | 11.3.0-1ubuntu1.3 |
| Ubuntu 26.04 LTS | pillow | 12.1.1-2ubuntu1.2 |
| Ubuntu Pro 14.04 LTS | pillow | no fix |
| Ubuntu Pro 16.04 LTS | pillow | no fix |
| Ubuntu Pro 18.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow-python2 | no fix |
| Wolfi | kubeflow-pipelines-visualization-server | 2.16.1-r0 |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | open-webui | 0.11.0-r0 |
| Wolfi | superset-6.0 | 6.0.0-r10 |