---
id: CVE-2026-112891
aliases:
  - GHSA-fc9g-5qg7-mf45
  - BIT-pillow-2026-112891
title: 'Pillow: Quadratic GIF comment copying during save'
summary: 'Pillow: Quadratic GIF comment copying during save'
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
vendor: pillow
product: pillow
ecosystem: pip
affected:
  - 'pillow >= 9.2.0, < 13.0.0'
patched:
  - pillow 13.0.0
published: '2026-10-21'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T08:56:06.483214483Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45'
references:
  - url: >-
      https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112891'
  - url: >-
      https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e
  - url: 'https://github.com/python-pillow/Pillow'
  - url: 'https://github.com/python-pillow/Pillow/releases/tag/13.0.0'
  - url: 'https://github.com/advisories/GHSA-fc9g-5qg7-mf45'
tags:
  - osv
  - pip
  - ghsa
  - cve.org
epss: 0.00479
epssPercentile: 0.41152
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-20T13:53:56.051448Z'
cvssSource: cna
cwe:
  - CWE-407
ingestedAt: '2026-10-19T21:43:56.113Z'
---

## Overview

On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.

## Affected packages

- `pillow >= 9.2.0, < 13.0.0`

## Remediation

Upgrade to a patched release:

- `pillow 13.0.0`