{"schema":"threatline.record/2","record":{"id":"CVE-2026-112891","aliases":["GHSA-fc9g-5qg7-mf45"],"summary":"Pillow: Quadratic GIF comment copying during save","details":"On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.","categories":["Libraries & packages"],"product":"pillow","vendor":"python-pillow","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","source_modified_at":"2026-10-21T20:38:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pillow"},"range":">= 9.2.0, < 13.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112891","source_modified_at":"2026-10-20T13:54:10.370Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Pillow","vendor":"python-pillow","versions":[{"version":">= 9.2.0, < 13.0.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45","source_modified_at":"2026-10-21T20:45:04.633756568Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.0"},{"fixed":"13.0.0"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","9.2.0","9.3.0","9.4.0","9.5.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","source_modified_at":"2026-10-21T20:38:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pillow"},"version":"13.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45","source_modified_at":"2026-10-21T20:45:04.633756568Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"version":"13.0.0"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00371,"percentile":0.29882,"score_date":"2026-10-23"},"published_at":"2026-10-19T21:33:32.180Z","modified_at":"2026-10-21T20:45:04.633756568Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T20:38:43Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112891","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T13:54:10.370Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T20:45:04.633756568Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112891","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112891","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-20T13:53:56.051448Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T20:45:04.633756568Z","content_hash":"a5e835695971ffa54f56bef291a2c8fe631340cc7965fa75e94057b3a5759d69"}}