CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin loop
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.
| CWE | CWE-835 |
| Vendor | python-pillow |
| Product | pillow |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for python-pillow pillow
Be the first to know when new unknown vulnerabilities affecting python-pillow pillow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
python-pillow / Pillow
< 13.0.0
References
github.com: https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 github.com: https://github.com/python-pillow/Pillow/pull/10012 github.com: https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d github.com: https://github.com/python-pillow/Pillow/releases/tag/13.0.0