Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.
References
Configurations
History
30 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 - Vendor Advisory |
27 Oct 2026, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d - Patch | |
| References | () https://github.com/python-pillow/Pillow/pull/10012 - Issue Tracking | |
| References | () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - Release Notes | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 - Vendor Advisory | |
| First Time |
Python
Python pillow |
|
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
21 Oct 2026, 21:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-21 21:20
Updated : 2026-10-30 17:17
NVD link : CVE-2026-96642
Mitre link : CVE-2026-96642
CVE.ORG link : CVE-2026-96642
JSON object : View
Products Affected
python
- pillow
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')