CVE-2026-112390: Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Q: Which deployments are exposed to this issue?

Applications using Pillow versions 7.2.0 through versions before 13.0.0 are affected when olefile is installed and they process MIC images in a way that reads n_frames or saves all frames. The impact is a worker consuming full CPU indefinitely.

Q: What must an attacker provide to trigger the denial of service?

An attacker must cause the application to read a crafted MIC file containing an embedded TIFF with at least three IFDs. No authentication or user interaction is required according to the supplied CVSS vector.

Q: Is a default Pillow installation necessarily affected?

No. The described behavior requires olefile to be installed and an application path that reads the MIC image frame count or saves all frames. The data does not establish that these conditions occur in every default installation.

Q: How can I remediate the issue?

Upgrade Pillow to version 13.0.0, which fixes the issue. If upgrading cannot happen immediately, avoid processing untrusted MIC files through operations that read n_frames or save all frames.

Published Oct 19, 2026

Updated

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads nframes or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.

Affected Software

1 affected component

pypi/Pillow>=7.2.0<13.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pillow to a version that resolves this vulnerability.
Fixed in 13.0.0

Event History

Oct 19, 2026

CVE Published

via MITRE·08:35 PM

Data Sourced

via MITRE·08:35 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using Pillow versions 7.2.0 through versions before 13.0.0 are affected when olefile is installed and they process MIC images in a way that reads n_frames or saves all frames. The impact is a worker consuming full CPU indefinitely.

What must an attacker provide to trigger the denial of service?

An attacker must cause the application to read a crafted MIC file containing an embedded TIFF with at least three IFDs. No authentication or user interaction is required according to the supplied CVSS vector.

Is a default Pillow installation necessarily affected?

No. The described behavior requires olefile to be installed and an application path that reads the MIC image frame count or saves all frames. The data does not establish that these conditions occur in every default installation.

How can I remediate the issue?

Upgrade Pillow to version 13.0.0, which fixes the issue. If upgrading cannot happen immediately, avoid processing untrusted MIC files through operations that read n_frames or save all frames.

CVE-2026-112390: Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the denial of service?

Is a default Pillow installation necessarily affected?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the denial of service?

Is a default Pillow installation necessarily affected?

How can I remediate the issue?