CVE-2026-112390 · GHSA-22hg-r758-rrw9
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
- Risk score
- 71/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pillow has an infinite loop vulnerability in MIC n_frames when the embedded TIFF has at least three IFDs, allowing an attacker to hold a worker at full CPU indefinitely.
- Affected
- {'product': 'pillow', 'package': 'Pillow', 'version': '>= 7.2.0, < 13.0.0'}
- Fix
- Upgrade to version 13.0.0 or later
- Exploitation
- Public proof of concept
Story map
At a glance
Pillow: Amber, patch this week. Pillow has an infinite loop vulnerability in MIC n_frames when the embedded TIFF has at least three IFDs, allowing an attacker to hold a worker at full CPU indefinitely.
The flaws
- CVE-2026-112390: Infinite loop in MIC n_frames when the embedded TIFF (CVSS 7.5 · EPSS 0%)
- CVE-2026-112391: PdfParser can recurse without limit in get_value() and linearize_page_tree() (CVSS 7.5 · EPSS 0%)
The fix
Upgrade Pillow: 13.0.0 or later on your release line
Who is exposed: {'product': 'pillow', 'package': 'Pillow', 'version': '>= 7.2.0, < 13.0.0'}
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-835 (CWE-835). 52 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: python, PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| Pillow | pip | >= 7.2.0, < 13.0.0 | 13.0.0 |
References
- https://github.com/advisories/GHSA-22hg-r758-rrw9
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9
- https://nvd.nist.gov/vuln/detail/CVE-2026-112390
- https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/advisories/GHSA-22hg-r758-rrw9
Original description
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.
Last activity 19 Oct 2026. Patch Forecast updates every hour.