Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218 Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 8
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-23 17:01
- StatusPublished → AnalyzedNVD modified 2026-10-23 17:01
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-20 15:02
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:48
- StatusReceived → PublishedNVD modified 2026-10-20 15:02
- StatusPublished → ReceivedNVD modified 2026-10-20 16:17
- StatusReceived → PublishedNVD modified 2026-10-19 20:35
- First seenCVSS 8.2NVD modified 2026-10-19 21:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218 Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 Exploit, Patch, Vendor Advisory