CVE-2026-112400: Pillow GIF Memory Exhaustion Vulnerability
Summary
CVE-2026-112400: Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS. Affects pillow versions >= 9.2.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and flexibility in handling images in web applications and data processing tasks. However, it is susceptible to vulnerabilities that can be exploited to cause denial of service (DoS) attacks, particularly when handling GIF images.
Vulnerability Detail
The vulnerability arises from the handling of GIF images in Pillow's GifImageFile._seek() method. When a GIF frame exceeds the decompression bomb threshold, Pillow raises a DecompressionBombError but retains the oversized dimensions in the image object. This allows an attacker to upload a specially crafted GIF that can lead to excessive memory allocation, potentially exhausting system resources and causing the application to crash or become unresponsive. The issue stems from the order of operations in the code, where the size is updated before the decompression bomb check is performed.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the seek method on GIF images that may exceed the decompression bomb threshold. Implement checks to validate image dimensions before processing GIF files, or catch and handle DecompressionBombError exceptions appropriately to prevent memory exhaustion.
Conclusion
The CVE-2026-112400 vulnerability in the Pillow library poses a significant risk for applications that process GIF images. By updating to the latest version of Pillow and implementing proper error handling, developers can mitigate the risk of denial of service attacks and ensure the stability of their applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112400 is a vulnerability in the Pillow library that allows for denial of service attacks through memory exhaustion when processing oversized GIF images.
If your application uses Pillow to handle GIF images and does not properly manage image dimensions, it may become unresponsive or crash due to excessive memory allocation.
Versions of Pillow from 9.2.0 to 12.x.x are affected by this vulnerability. It is recommended to upgrade to version 13.0.0 or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
