CVE-2026-112399 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the Pillow Python imaging library, spanning versions from 8.1.0 through 13.0.0, represents a critical resource exhaustion flaw rooted in the order of operations during image processing initialization. Specifically, this issue affects the handling of Animated Portable Network Graphics (APNG) files where the application attempts to allocate memory for the entire canvas background before validating whether the file constitutes a decompression bomb or exceeds safe size limits. This architectural oversight allows an attacker to craft malicious APNG images that trigger excessive memory consumption during the initial opening phase, leading directly to denial of service conditions in any system relying on Pillow for image processing tasks.
The technical mechanism behind this vulnerability involves the specific sequence executed when Image.open() is called on a crafted APNG file. The flaw manifests when an attacker constructs an APNG with a small first frame but declares a significantly larger canvas size, combined with disposal methods such as OP_PREVIOUS or background disposal settings that require the full canvas buffer to be initialized immediately. Upon invocation of Image.open(), which positions itself at frame zero, the library proceeds to allocate memory for the complete canvas dimensions before applying any decompression-bomb checks or pixel loading operations. This means that even if subsequent frames are small or compressed efficiently, the initial allocation based on the declared canvas size occurs unconditionally during the open operation, bypassing standard safety thresholds designed to prevent resource abuse.
From an operational perspective, this vulnerability poses a severe risk of denial of service by exhausting available system memory. Since the full-canvas allocation happens inside Image.open() without requiring pixel loading or frame iteration, it can be triggered simply by opening the file rather than processing its content extensively. In environments where Pillow is used to process user-uploaded images, such as web applications, document converters, or automated media pipelines, an attacker could upload a maliciously crafted APNG that causes the application server to consume all available RAM rapidly. This leads to application crashes, system instability, or complete service unavailability for legitimate users, effectively turning image processing capabilities into a vector for resource exhaustion attacks.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to properly limit the amount of resources consumed during input validation and initialization phases. Furthermore, it relates to CWE-787, Out-of-bounds Write, in contexts where memory allocation failures might lead to undefined behavior or crashes due to insufficient heap space management. In terms of offensive security frameworks, this flaw supports techniques associated with ATT&CK T1496, Resource Hijacking, specifically under the subcategory of Denial of Service via resource exhaustion. Attackers can leverage this weakness to disrupt services without needing code execution privileges, making it a potent tool for availability-focused attacks against systems dependent on image parsing libraries.
The issue was addressed in version 13.0.0 of Pillow by reordering the validation logic to ensure that decompression-bomb checks and size limits are applied before allocating memory for the full canvas background. This fix ensures that maliciously crafted files with exaggerated dimensions are rejected early in the process, preventing unnecessary resource allocation. Organizations utilizing affected versions should upgrade immediately to version 13.0.0 or later to mitigate this risk. Additionally, implementing strict input validation and size limits at the application layer can provide defense-in-depth measures against similar vulnerabilities in other image processing libraries that may suffer from analogous ordering flaws during initialization sequences.