Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2026-42310

CVE-2026-42310

MEDIUM5.5

Pillow: PDF Parsing Trailer Infinite Loop (DoS)

Published May 9, 2026

Modified 4 days ago

Details

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

References

https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468

https://github.com/python-pillow/Pillow/pull/9519

https://github.com/python-pillow/Pillow/releases/tag/12.2.0

https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7

https://www.cve.org/CVERecord?id=CVE-2026-42310

CVSS Analysis

CVSS v4.0

5.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

NoneVI:N

Vuln. Availability

LowVA:L

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

5.1/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Weakness Type (CWE)

Other

Ecosystems

Timeline

PublishedMay 9, 2026

ModifiedMay 12, 2026

CVE-2026-42310 | Mondoo Vulnerability Intelligence