CVE-2026-112891Medium· 6.9▾ SunlitPillow: Quadratic GIF comment copying during save
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
0.4% → 0.5%
On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes _get_global_header() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.
pillow >= 9.2.0, < 13.0.0Upgrade to a patched release:
pillow 13.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112401Medium· 6.9Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
CVE-2026-96643High· 7.1Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-112894High· 7.5Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-96637High· 7.1Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96636Medium· 6.5Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions