EUVD-2026-104649

Pillow: Quadratic GIF comment copying during save...

Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

GHSA-FC9G-5QG7-MF45 Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) is vulnerable to a quadratic copying issue when saving a GIF file containing a long comment. The root cause is located in the _get_global_header() function, which repeatedly copies portions of comment data from an untrusted input ...