All vulnerabilities
CVE-2026-112891GHSA-fc9g-5qg7-mf45

Pillow: Quadratic GIF comment copying during save

python-pillow pillowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in13.0.0Fixed versionGitHub
Published19 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 13.0.0pillow, pipGitHub
  • 13.0.0pillow, PyPIOSVpip install "pillow>=13.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes _get_global_header() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.

Text from CVE List

Affected versions 22

  • pillow, pip>= 9.2.0, < 13.0.0GitHub
  • Pillowaffected: >= 9.2.0, < 13.0.0CVE List
  • pillow, PyPIfrom 9.2.0, fixed in 13.0.0OSV
  • pillow, PyPI10.0.0OSV
  • pillow, PyPI10.0.1OSV
  • pillow, PyPI10.1.0OSV
  • pillow, PyPI10.2.0OSV
  • pillow, PyPI10.3.0OSV
  • pillow, PyPI10.4.0OSV
  • pillow, PyPI11.0.0OSV
  • pillow, PyPI11.1.0OSV
  • pillow, PyPI11.2.1OSV
  • pillow, PyPI11.3.0OSV
  • pillow, PyPI12.0.0OSV
  • pillow, PyPI12.1.0OSV
  • pillow, PyPI12.1.1OSV
  • pillow, PyPI12.2.0OSV
  • pillow, PyPI12.3.0OSV
  • pillow, PyPI9.2.0OSV
  • pillow, PyPI9.3.0OSV
  • pillow, PyPI9.4.0OSV
  • pillow, PyPI9.5.0OSV

References 5