CVE-2026-112406

Affected versions of the Pillow package are vulnerable to Infinite Loop due to an unbounded upward traversal of the PDF page tree. The `PdfParser.rewrite_pages()` method, specifically the `while pages_tree_node_ref:` loop at `src/PIL/PdfParser.py:505`, walks each page's `/Parent` chain upward until it encounters a node without a `/Parent` entry, but it keeps no record of previously visited nodes, so a cycle in the chain (for example, a `/Pages` root whose `/Parent` points back to itself) causes the loop to never terminate. An attacker can craft a small, malformed PDF in which a page-tree node's `/Parent` reference forms a cycle, and when an application calls `im.save(fp, "PDF", append=True)` on that file via `PdfImagePlugin._save()` and `write_catalog()`, the worker thread or process enters an endless loop consuming 100% of a CPU core, resulting in a Denial of Service that only an external timeout can interrupt.