CVE-2026-112390High· 8.2▾ TwilightPillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream ind…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.
Pillow >= 7.2.0, < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112391Medium· 6.3Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
CVE-2026-112406High· 8.7Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112394Medium· 6.3Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112396Medium· 5.9Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
CVE-2026-112395Medium· 6.5Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
CVE-2026-112398Critical· 9.2Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution