{"id":"CVE-2026-96642","published":"2026-10-21T21:20:32.650","lastModified":"2026-10-22T16:46:48.920","description":"Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d","tags":[]},{"url":"https://github.com/python-pillow/Pillow/pull/10012","tags":[]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","tags":[]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7","tags":[]}],"exploitRefs":[{"url":"https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d","tags":[]},{"url":"https://github.com/python-pillow/Pillow/pull/10012","tags":[]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","tags":[]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7","tags":[]}],"hasPoc":true,"ai":null}