CVE-2026-112891

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) is vulnerable to a quadratic copying issue when saving a GIF file containing a long comment. The root cause is located in the _get_global_header() function, which repeatedly copies portions of comment data from an untrusted input ...