DailyCVE@dailycve
🔴 Pillow, Infinite Loop Denial of Service, #CVE-2026-96642 (High) -DC-Oct2026-3621 https://dailycve.com/pillow-infinite-loop-denial-of-service-cve-2026-96642-high-dc-oct2026-3621/
0000022
243 followersView on X
CVE-2026-96642
LOWCVSS 7.1 · HIGHImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-835
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE