Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-112399 Details

Description

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9	CISA-ADP	ExploitMitigationPatchVendor Advisory
https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48	[email protected]	Patch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0	[email protected]	Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9	[email protected]	ExploitMitigationPatchVendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-789	Memory Allocation with Excessive Size Value	[email protected]

Affected Products

Product	Versions
python pillow	>= 8.1.0, < 13.0.0
CPE cpe:2.3:a:python:pillow:::::::: Remediation No remediation found in references.

Change History

3 change records found show changes

Date	Action	Recorded By
Oct 28, 2026	CVE Modified	CISA-ADP
Oct 27, 2026	Initial Analysis	[email protected]
Oct 19, 2026	New CVE Received	[email protected]