VDB
CVE-2026-112891
CVE-2026-112891
PUBLISHED
CVSS 6.9 MEDIUM
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 9.2.0, < 13.0.0 |
| chainguard | nemo-gym | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| PyPI | Pillow | 9.2.0 |
| chainguard | py3-pillow | 0 |
| wolfi | py3-pillow | 0 |
| chainguard | superset-fips-6.1 | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| chainguard | apache-beam-python-3.12-sdk | 0 |
| python-pillow | Pillow | 9.2.0 |
| wolfi | open-webui | 0 |
| chainguard | open-webui | 0 |
| chainguard | openstack-horizon-2025.2 | 0 |
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112891 advisory
- https://github.com/advisories/GHSA-fc9g-5qg7-mf45 advisory