CVE-2026-112400

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

En bref

Sévérité: HIGH 8.7
EPSS: EPSS 0.51 % · centile 43 (2026-10-27)
État: PUBLISHED
Publiée: 2026-10-19
Mise à jour: 2026-10-20
Attribuée par: GitHub_M
Statut NVD: Analyzed

Description

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

Avis

GHSA-65qm-jvmh-6pqg — Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Références européennes

ENISA EUVD · EUVD-2026-104636
GCVE · GCVE-0-2026-112400

Configurations affectées (CPE NVD)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* ≥ 9.2.0 < 13.0.0

Produits affectés

Produit	Versions
python-pillow · Pillow	affected >= 9.2.0, < 13.0.0

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD