CVE-2026-112390

Received Received - Intake

Pillow Infinite Loop in MIC Image Frame Count

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112390

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 7.2.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

Pillow, a Python imaging library, has a flaw in versions 7.2.0 to 13.0.0 where it can enter an infinite loop while processing MIC images. This happens because the library incorrectly handles frame counting in embedded TIFF files within MIC files, causing it to repeatedly check the same frames without advancing.

Detection Guidance

This vulnerability can be detected by checking the version of Pillow installed on your system. Run 'pip show Pillow' or 'python -c "import PIL; print(PIL.__version__)"' to verify if the version is below 13.0.0. Additionally, monitor CPU usage for processes handling MIC files, as an infinite loop may indicate exploitation.

Impact Analysis

If you process or save frames from a crafted MIC file using an affected Pillow version, your application may freeze or consume 100% CPU indefinitely. This could disrupt services relying on image processing, especially in automated workflows.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. Use 'pip install --upgrade Pillow' or your package manager to update. If upgrading is not possible, avoid processing MIC files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70