CVE-2026-112891

Received Received - Intake

Memory Exhaustion in Pillow GIF Processing

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112891

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 9.2.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. From version 9.2.0 to 12.9.9, it has a flaw where saving a GIF with a long comment causes quadratic copying in _get_global_header(). This means the library repeatedly copies portions of the comment data while building the global header, including comments from untrusted input images. An attacker can exploit this by providing a specially crafted image with a large GIF comment, leading to excessive CPU usage and potential denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of Pillow (9.2.0 to 13.0.0). Run 'pip show Pillow' to check the installed version. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

This vulnerability can impact you by causing high CPU usage and system slowdowns when processing or saving GIF images with long comments. In severe cases, it may lead to denial of service, where the application or system becomes unresponsive or crashes. Users or systems relying on Pillow for image processing could experience degraded performance or downtime.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. Use 'pip install --upgrade Pillow' to apply the fix. If upgrading is not possible, avoid processing untrusted GIF files with comments until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-112891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70