CVE-2026-112401

Received Received - Intake

Pillow GIF Comment Parsing Quadratic Copying DoS

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open(). An attacker can submit a small-dimension GIF containing many comment extensions to any application that opens the file. This can consume excessive CPU and deny service before the application can inspect the image. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112401

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 5.4.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library affected by a denial-of-service vulnerability in versions 5.4.0 to 13.0.0. The issue occurs when parsing GIF files with many comment extensions. The library performs quadratic copying of comment data, causing excessive CPU usage and potential service disruption.

Detection Guidance

Check if your system uses Pillow versions between 5.4.0 and 13.0.0 by running: pip show pillow. If installed, verify the version. Monitor CPU usage spikes when processing GIF files, as excessive CPU consumption may indicate exploitation.

Impact Analysis

An attacker could exploit this by providing a maliciously crafted GIF file with numerous comment extensions. Opening such a file in any application using the vulnerable Pillow version may lead to high CPU consumption, system slowdowns, or denial of service before the image can even be inspected.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later using: pip install --upgrade pillow. If upgrading is not possible, avoid processing untrusted GIF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70