Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-112390— Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Quick assessment

Affected

python-pillow Pillow

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pillow 是一个 Python 图像处理库。在 7.2.0 到 13.0.0 版本之间，Pillow 在计算 MIC 图像的帧数时可能陷入无限循环。MicImageFile 类继承了 TIFF 的帧遍历机制，但其方法返回的是 OLE 流索引，而方法会重置 TIFF 帧状态。因此，若 MIC 文件中嵌入了包含至少三个 IFD（图像文件目录）的 TIFF 数据，帧遍历将永远无法推进。当安装了的应用程序读取恶意构造的 MIC 文件的属性或尝试保存所有帧时，这种无法推进的遍历会导致工作线程长期占用 100% 的

CVSS 8.2 · High Updated Oct 20, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Source: CVE Program / CVE List V5

Vulnerability Description

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不可达退出条件的循环(无限循环)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
python-pillow	Pillow	>= 7.2.0, < 13.0.0	-

II. Public POCs for CVE-2026-112390

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112390

请登录查看更多情报信息。

Other References for CVE-2026-112390 (3)

https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9 x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-112390

Same Patch Batch · python-pillow · 2026-10-19 · 27 CVEs total

CVE-2026-112403	9.2 CRITICAL	Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112393	9.2 CRITICAL	Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112398	9.2 CRITICAL	Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112900	9.2 CRITICAL	Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112896	8.8 HIGH	Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112404	8.8 HIGH	Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
CVE-2026-112399	8.7 HIGH	Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-112397	8.7 HIGH	Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-112402	8.7 HIGH	Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-112897	8.7 HIGH	Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112400	8.7 HIGH	Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112894	8.7 HIGH	Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112406	8.7 HIGH	Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112892	8.7 HIGH	Pillow: MSP RLE decoder expands a tiny file into unbounded memory
CVE-2026-112405	8.7 HIGH	Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE-2026-112895	8.7 HIGH	Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for C
CVE-2026-112392	8.2 HIGH	Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112893	8.2 HIGH	Pillow: Invalid free in FreeType glyph rendering when a stroker is active
CVE-2026-112898	6.9 MEDIUM	Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
CVE-2026-112901	6.9 MEDIUM	Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Pillow

Same vendor: python-pillow

Same weakness: CWE-835

V. Comments for CVE-2026-112390

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-112390— Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-112390

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-112390

III. Intelligence Information for CVE-2026-112390

Other References for CVE-2026-112390 (3)

Same Patch Batch · python-pillow · 2026-10-19 · 27 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-112390

Leave a comment