CVE-2026-96642CWE-835

CVE-2026-96642

published October 22, 2026

CVSS
7.1
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-10-22T01:20Z
References (4)
https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d · [email protected]https://github.com/python-pillow/Pillow/pull/10012 · [email protected]https://github.com/python-pillow/Pillow/releases/tag/13.0.0 · [email protected]https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 · [email protected]
EPSS history
Timeline
  • 23 OCT 04:10Z
    EPSS moved — → 0%
    epss
  • 21 OCT 20:49Z
    Pillow: TarIO negative size field causes infinite CPU-spin loop
    cvelistv5
  • 21 OCT 20:49Z
    Pillow: TarIO negative size field causes infinite CPU-spin loop
    cvelistv5