CVE-2026-112401

The Pillow Python imaging library is vulnerable to a Denial of Service (DoS) condition due to inefficient algorithmic complexity (CWE-407) during GIF comment parsing. Specifically, in versions 5.4.0 through 12.9.0 , the GifImageFile._seek() method performs quadratic copying by repeatedly appendin...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...