CVE-2026-112891CWE-407

CVE-2026-112891

published October 20, 2026

CVSS
6.9
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-10-20T02:17Z
References (3)
https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e · [email protected]https://github.com/python-pillow/Pillow/releases/tag/13.0.0 · [email protected]https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 21:33Z
    Pillow: Quadratic GIF comment copying during save
    cvelistv5
  • 19 OCT 21:33Z
    Pillow: Quadratic GIF comment copying during save
    cvelistv5