CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin loop
Reported by github_m · Published October 21, 2026
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| pillow | python | 13.0.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | < 13.0.0 |
| python-pillow | Pillow | 0 |
| chainguard | nemo-gym | 0 |
| chainguard | superset-fips-6.1 | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| PyPI | Pillow | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
Timeline
- Oct 21, 2026 CVE Published
- Oct 22, 2026 EPSS Score (5 in total, the first dated here)
- Oct 22, 2026 Coalition ESS Score
- Oct 30, 2026 CVE Updated
- Oct 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-96642
vulnetix vdb fixes CVE-2026-96642Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-96642/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/pull/10012 x_refsource_MISC
- https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-96642 advisory
- https://github.com/advisories/GHSA-3j72-p6qg-6xp7 advisory