CVE-2026-42310: Python Pillow

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

Affected products

• Python Pillow: from 4.2.0, before 12.2.0 (fixed in 12.2.0)

Published 2026-05-09. Last modified 2026-07-24.