Pillow: Memory exhaustion via crafted APNG during Image.open()
Summary
Pillow, a Python imaging library, allocates and fills a full-canvas memory buffer for animated PNG files (APNG) with background or previous-frame disposal before the decompression bomb check runs. A crafted file of about 126 bytes can therefore cause a multi-gigabyte memory spike when opened with default settings. An attacker who can make an application open an untrusted image can exhaust memory and crash the process (denial of service).
Affected
- Pillow 8.1.0 up to, but not including, 13.0.0 (GHSA lists 8.1.0 through 12.3.0)
Fixed in
- Pillow 13.0.0
Workaround
- Reject animated PNG uploads (detect the acTL chunk before the first IDAT) at the application or proxy layer
- Enforce upload size and memory limits for image processing
- No workaround is provided in the CVE record
Exploitation
- No known exploitation in the wild at the time of research; not verified against the CISA KEV catalogue
- No public proof of concept found; EPSS 0.00386
- CISA SSVC: exploitation poc, automatable yes, technical impact partial
Our recommendation
- Inventory Python environments and container images for Pillow below 13.0.0, including transitive dependencies
- Upgrade to Pillow 13.0.0 or later and rebuild containers
- Until patched, apply the APNG rejection and memory limits on public upload paths
- Check distribution vendor advisories for OS-packaged Pillow versions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5xm2-6676-qcp9 github.com
- Pillow 13.0.0 release github.com
- Pillow 13.0.0 release notes pillow.readthedocs.io
- Fix commit f1acfc54 github.com
- Xpra issue 5096 (APNG mitigation discussion) github.com
- OSV BIT-pillow-2026-112399 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:53.
Original description (NVD)
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.
NVD references (4)
- https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.