VDB
CVE-2026-112390
CVE-2026-112390
PUBLISHED
CVSS 8.2 HIGH
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 4.0
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 7.2.0, < 13.0.0 |
| chainguard | nemo-gym | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| chainguard | py3-pillow | 0 |
| wolfi | py3-pillow | 0 |
| python-pillow | Pillow | 7.2.0 |
| chainguard | openstack-horizon-2025.2 | 0 |
| wolfi | open-webui | 0 |
| chainguard | open-webui | 0 |
| chainguard | apache-beam-python-3.12-sdk | 0 |
| chainguard | superset-fips-6.1 | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| PyPI | Pillow | 7.2.0 |
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 23, 2026 CVE Updated
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
- Oct 31, 2026 EPSS Score
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218 x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112390 advisory
- https://github.com/advisories/GHSA-22hg-r758-rrw9 advisory