CVE-2026-112390: Pillow Infinite Loop Vulnerability in MIC n_frames Handling
Summary
CVE-2026-112390: Pillow: Infinite loop in MIC n_frames when the embedded TIFF. Affects pillow versions >= 7.2.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It supports numerous image formats, including TIFF, JPEG, PNG, and many others, making it a popular choice for developers working with images in Python applications. The library is designed to be easy to use while offering powerful features for image processing. However, a vulnerability has been identified in the handling of Microsoft Image Composer (MIC) files, specifically in the way the library processes the number of frames in embedded TIFF images.
Vulnerability Detail
The vulnerability arises from an infinite loop in the n_frames property of the MicImageFile class when it encounters an embedded TIFF file with three or more Image File Directories (IFDs). This issue was introduced in version 7.2.0 of Pillow and can lead to a denial of service, as the application may consume 100% CPU indefinitely when attempting to read the number of frames in a crafted MIC file. The loop occurs because the tell() method returns a constant stream index, preventing the expected advancement through the IFDs, thus causing the loop to repeat indefinitely without raising an exception or consuming additional memory.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update Pillow, consider avoiding the use of the olefile package, which is an optional dependency that enables the MIC plugin. Without olefile, the MIC functionality will not be registered, thus mitigating the risk of this vulnerability. Additionally, ensure that any untrusted image files are not processed by your application.
Conclusion
The CVE-2026-112390 vulnerability in the Pillow library poses a significant risk for applications that process MIC files with multiple frames. By updating to the patched version 13.0.0 or later, developers can mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112390 is a vulnerability in the Pillow library that causes an infinite loop when processing certain Microsoft Image Composer (MIC) files with multiple frames.
If your application uses Pillow to open untrusted MIC files, it may enter an infinite loop, consuming CPU resources and potentially leading to a denial of service.
The vulnerability affects Pillow versions prior to 13.0.0. It was introduced in version 7.2.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
