Patch Forecast
Amber warning
Patch this week.

CVE-2026-112399 · GHSA-5xm2-6676-qcp9

Pillow: APNG background disposal allocates full canvas before decompression bomb check

Risk score
66/100
CVSS
8.7 v4.0
Exploit chance (30 days)
0.3%
Published
19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Pillow, a Python imaging library, can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check, potentially exhausting memory and denying service. An attacker could exploit this vulnerability to cause a denial of service.
Affected
{'products': ['Pillow'], 'packages': ['Pillow'], 'versions': ['>= 8.1.0, < 13.0.0']}
Fix
Upgrade to version 13.0.0 or later
Exploitation
No known exploitation

Story map

Story map: PillowTHE FLAWSTHE FIXCVE-2026-112399APNG background disposalallocates full canvas beforedecompression bomb checkCVSS 8.7 · EPSS 0%CVE-2026-112393Heap buffer overflow in_tiffWriteProc when savingTIFF to BytesIOCVSS 9.2 · EPSS 1%CVE-2026-96639Pillow multi-frame loaders canreuse stale native imagestorage after mode transitionsCVSS 9.8 · EPSS 1%CVE-2026-112900Argument Injection inGhostscript call, potentiallyleading into RCECVSS 9.2 · EPSS 0%Upgrade Pillow13.0.0or later on your release lineWho is exposed{'products': ['Pillow'],'packages': ['Pillow'], 'versions':['>= 2.0.0, < 13.0.0']}AMBER · PATCH THIS WEEKPillowPillow has a heap bufferoverflow and stale-heapdisclosure in _tiffWriteProcwhen saving compressed TIFFdata through libtiff to a targetwithout a usable fileno(). Thiscan crash the process and may…Where it standsPublic proof of concept1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.23 Oct · The Hacker NewsCritical Flaw in Python’s Popular Pillow ImageLibrary Allows Code Execution via a Crafted ImageCONNECTS TOSame weaknessCWE-789 (CWE-789)45 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pillow: Amber, patch this week. Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(). This can crash the process and may allow code execution.

The flaws

  • CVE-2026-112399: APNG background disposal allocates full canvas before decompression bomb check (CVSS 8.7 · EPSS 0%)
  • CVE-2026-112393: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVSS 9.2 · EPSS 1%)
  • CVE-2026-96639: Pillow multi-frame loaders can reuse stale native image storage after mode transitions (CVSS 9.8 · EPSS 1%)
  • CVE-2026-112900: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.2 · EPSS 0%)

The fix

Upgrade Pillow: 13.0.0 or later on your release line

Who is exposed: {'products': ['Pillow'], 'packages': ['Pillow'], 'versions': ['>= 2.0.0, < 13.0.0']}

Where it stands

  • Public proof of concept
  • 1 outlet covering it

How it unfolded

  1. 23 Oct, The Hacker News (press): Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Connects to

Why it is Amber

  • CVSS 8.7 high
  • Remotely exploitable without logging in
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
Pillowpip>= 8.1.0, < 13.0.013.0.0

References

Original description

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.

Last activity 19 Oct 2026. Patch Forecast updates every hour.