CVE-2026-112400
published 2026-10-19CVE-2026-112400: Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.51%
43.4th percentile
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | — | — |
| python | pillow | >= 9.2.0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image
vendor_redhat·2026-10-19·CVSS 8.7
CVE-2026-112400 [HIGH] CWE-770 pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image
pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image
A flaw was found in Pillow. When parsing a crafted GIF image, the library fails to discard rejected frame dimensions after encountering an excessively large image exception. If an application catches this exception and continues processing the image, subsequent operations attempt to allocate memory based on the oversized dimensions. A remote attacker can exploit this issue to exhaust system memory, resulting in a Denial of Service (DoS).
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-to
VulDB
Pillow up to 12.x Gif GifImageFile._seek resource consumption
vuldb·2026-10-20·CVSS 8.7
CVE-2026-112400 [HIGH] Pillow up to 12.x Gif GifImageFile._seek resource consumption
A vulnerability classified as problematic was found in Pillow up to 12.x. This affects the function GifImageFile._seek of the component Gif Handler. The manipulation results in resource consumption.
This vulnerability is reported as CVE-2026-112400. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
ghsa·2026-10-20
CVE-2026-112400 [HIGH] CWE-400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
```
GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
```
A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after com
No detection rules found.
No public exploits indexed.
https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqghttps://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg
2026-10-19
Published