CVE-2026-112400

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) contains a vulnerability where the GifImageFile._seek function fails to discard rejected frame dimensions after an Image.DecompressionBombError . A remote attacker can provide a crafted GIF that triggers this exception; if the app...

CVE-2026-112400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...