CVE-2026-112391

Affected versions of the Pillow package are vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop') due to an ineffective recursion-depth guard in `PdfParser.get_value()`. The `get_value()` classmethod accepts a `max_nesting` parameter that defaults to -1 and is decremented on every recursive call for nested arrays, dictionaries, and indirect object definitions, but its guard only checks for `max_nesting == 0`, a value that is never reached since the counter starts negative and only decreases further; this same unbounded recursion is also reachable through `linearize_page_tree()`. An attacker who supplies a crafted PDF file containing deeply nested objects (such as an array nested several thousand levels deep) can trigger this condition when the file is parsed via `PdfParser`, reachable through `Image.save(im, fp=<pdf>, format="PDF", append=True)` on an attacker-controlled PDF, causing an uncaught `RecursionError` that crashes the process and results in a Denial of Service.