CVE-2026-112891: python pillow

CVSS 7.5 (high) · published 2026-10-19

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0.

Affected products (NVD): python pillow

Fixed in (NVD): 13.0.0

Weakness: CWE-407

Source: NVD CVE-2026-112891

References

• https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.