CVE-2026-112399: Pillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OPPREVIOUS reaches PngImageFile.seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which Pillow versions are affected and which version fixes the issue?
Pillow versions from 8.1.0 up to, but not including, 13.0.0 are affected. The issue is fixed in Pillow 13.0.0.
What input is required to trigger the denial of service?
An attacker needs to supply a crafted APNG with a small first frame, a very large declared canvas, and either background disposal or first-frame OP_PREVIOUS. No authentication or user interaction is required according to the supplied CVSS vector.
Can the issue be triggered during basic image inspection rather than image decoding?
Yes. The full-canvas allocation can occur inside Image.open() while Pillow positions frame zero, without pixel loading or frame iteration. Applications that open untrusted APNG files may therefore be exposed even if they do not explicitly decode image pixels.
What is the impact of successful exploitation?
The crafted APNG can cause a full-canvas memory allocation before the decompression-bomb check is applied. This can exhaust available memory and deny service.