CVE-2026-112400

Received Received - Intake

Pillow GIF Decompression Bomb Memory Exhaustion

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112400

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 9.2.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Pillow Python imaging library versions 9.2.0 to 13.0.0. A crafted GIF file can cause Pillow to retain rejected frame dimensions after a decompression-bomb exception. If an application catches this exception and continues processing the same image, later operations may allocate excessive memory based on these dimensions, leading to denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of Pillow installed on your system. Run 'pip show Pillow' or 'python -c "import PIL; print(PIL.__version__)"' to verify if the version is below 13.0.0. If it is, the system is vulnerable.

Impact Analysis

This vulnerability can cause applications using affected Pillow versions to crash or become unresponsive due to excessive memory consumption when processing malicious GIF files. It may lead to service outages or degraded performance for applications handling untrusted image inputs.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. Use 'pip install --upgrade Pillow' or update via your package manager to apply the fix.

Hi! I’m here to help you understand CVE-2026-112400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70