Pillow: Denial of service via stale GIF frame size after decompression bomb error
Summary
Pillow, a Python imaging library, keeps a rejected GIF frame size on the image object after a DecompressionBombError is raised in GifImageFile._seek(). A crafted GIF of about 60 bytes can then cause later seek, load, new-image or rotate operations to allocate gigabytes of memory. The attack requires an application that catches this exception and keeps using the same image object, for example an upload service that processes user-supplied GIFs. A successful attack exhausts memory and denies service; there is no memory corruption.
Affected
- Pillow >= 9.2.0 and < 13.0.0 (CVE record)
- The GitHub advisory lists affected versions as <= 12.3.0
- Python 3.10 hosts: no fixed Pillow release supports Python 3.10 (secondary, unverified)
Fixed in
- Pillow 13.0.0 (fix commit 6faed707cfb760a4cbd726ddc8406f576cf35bf7)
Workaround
- No workaround provided by the vendor.
- Discard the image object after catching DecompressionBombError and do not reuse it.
Exploitation
- Not known to be exploited in the wild; not listed in KEV.
- Public proof of concept: yes (CISA SSVC: exploitation poc, automatable yes).
- Technical impact: partial (availability).
Our recommendation
- Inventory all Pillow installations, including transitive dependencies and vendor-bundled copies, and flag versions below 13.0.0.
- Upgrade to Pillow 13.0.0 where Python 3.11 or newer is available; plan a migration for Python 3.10 hosts.
- Review code that catches DecompressionBombError and stop reusing the image object after the exception.
- Prioritise public-facing services that accept user-uploaded GIFs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-65qm-jvmh-6pqg github.com
- Pillow 13.0.0 release github.com
- Fix commit 6faed707 github.com
- OSV BIT-pillow-2026-112400 osv.dev
- Ubuntu CVE tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:54.
Original description (NVD)
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.
NVD references (4)
- https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.