Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7 Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg Exploit, Mitigation, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg Exploit, Mitigation, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 8
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-27 21:02
- StatusPublished → AnalyzedNVD modified 2026-10-27 21:02
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-20 14:59
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:50
- StatusReceived → PublishedNVD modified 2026-10-20 14:59
- StatusPublished → ReceivedNVD modified 2026-10-20 15:17
- StatusReceived → PublishedNVD modified 2026-10-19 21:12
- First seenCVSS 8.7NVD modified 2026-10-19 22:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7 Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg Exploit, Mitigation, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg Exploit, Mitigation, Patch, Vendor Advisory