cyfenced.com →

[ CVE-2026-96642 · Published 21 Oct 2026 ]

Pillow: TarIO negative size field causes infinite CPU-spin loop

CVSS 7.1 EPSS <1%Fix available

[ Description ]Official description

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

[ Fixes ]Fixes and patches

  • Pillow 13.0.0Fixed version · GitHub Advisories · pip package Pillow: upgrade to 13.0.0 or later (affected < 13.0.0)

[ Packages ]Affected open-source packages

[ References ]References