VDB
CVE-2026-112400
CVE-2026-112400
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 9.2.0, < 13.0.0 |
| wolfi | kubeflow-pipelines-visualization-server | 0 |
| chainguard | netbox-fips | 0 |
| chainguard | pgadmin4-fips | 0 |
| chainguard | open-webui | 0 |
| chainguard | openstack-horizon-2026.1 | 0 |
| wolfi | kserve | 0 |
| chainguard | kubeflow-pipelines-visualization-server | 0 |
| wolfi | superset-6.1 | 0 |
| chainguard | label-studio | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| chainguard | netbox | 0 |
| chainguard | py3-pillow | 0 |
| chainguard | kserve | 0 |
| wolfi | py3-pillow | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| chainguard | gftools | 0 |
| chainguard | nemo-gym | 0 |
| chainguard | jupyter-all-spark-notebook | 0 |
| python-pillow | Pillow | >= 9.2.0, < 13.0.0 |
…and 8 more
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 CVE Updated