CVE-2026-112390
8.2HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-835
Impact
Remote unauthenticated attackers can cause a persistent denial of service by pegging worker processes at 100% CPU. They only need to supply a crafted MIC image to an application reading image frames with olefile installed.
Root cause
MicImageFile inherits TIFF frame traversal but its seek and tell methods conflict with OLE stream positions, creating an infinite loop when counting frames on files with three or more IFDs.
Affected systems
Pillow 7.2.0 through 12.x (fixed in 13.0.0)
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Pillow to version 13.0.0 or later. If patching immediately is not possible, reject or sanitize uploaded MIC images before frame processing.
$ pip install --upgrade "pillow>=13.0.0"AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.