GHSA-P8HX-V2P6-RP84 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...