CVE-2026-112400

— UNSCOREDpublic exploit available

Published 2026-10-19 · Updated 2026-10-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.

Weaknesses

CWE-400, CWE-770

Public exploit & PoC references

https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg

All references

https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100350PoC
UNSCOREDCVE-2026-101896PoC
UNSCOREDCVE-2026-101911PoC
MEDIUMCVE-2026-102821PoC
HIGHCVE-2026-102993PoC
MEDIUMCVE-2026-107166PoC
MEDIUMCVE-2026-108768PoC
MEDIUMCVE-2026-109932PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.