Denial of Service Vulnerability in Pillow Imaging Library

CVE-2026-112401

What is CVE-2026-112401?

The Pillow imaging library, used for handling images in Python, contains a vulnerability that arises during the processing of GIF files. Specifically, when an application opens a GIF containing numerous comment extensions, Pillow can enter a state of excessive CPU consumption. This happens due to the way Pillow performs quadratic copying while parsing GIF comments, which can lead to a denial of service as the application becomes overwhelmed before it can even analyze the image. This vulnerability has been addressed in version 13.0.0, highlighting the importance of keeping the library up to date to ensure application reliability.

References