CVE-2026-112401

The record

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open(). An attacker can submit a small-dimension GIF containing many comment extensions to any application that opens the file. This can consume excessive CPU and deny service before the application can inspect the image. This issue is fixed in version 13.0.0.

Affected packages

Related vulnerabilities

• CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result… CWE-407
• CVE-2026-112894 Pillow is a Python imaging library. CWE-407
• CVE-2026-112891 Pillow is a Python imaging library. CWE-407
• CVE-2026-111766 markdown-it is a Markdown parser. CWE-407
• CVE-2026-111759 markdown-it is a Markdown parser. CWE-407
• CVE-2026-95838 containerd is an open-source container runtime. CWE-407
• CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does… CWE-407
• CVE-2026-104182 stream-json is a micro-library of stream components for processing JSON and JSONC with a… CWE-407