Каталог CVE

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until…

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.

Критичність: High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Oct 19, 2026, 9:12:37 PM UTC
Updated: Oct 19, 2026, 10:17:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.51% · Oct 27, 2026

Projects and upstream resources

[pillow][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	pillow	`13.0.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-112400]

Showing 1 fix observations. All 54 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	pillow	Not reported	AffectedDistribution reports no fix	[CVE-2026-112400]
Debianbookworm	pillow	`9.4.0-1.1+deb12u1`	Affected	[CVE-2026-112400]
Debianbookworm-security	pillow	`9.4.0-1.1+deb12u1`	Affected	[CVE-2026-112400]
Debianforky	pillow	Not reported	AffectedDistribution reports no fix	[CVE-2026-112400]
Debianforky	pillow	`12.3.0-1`	Affected	[CVE-2026-112400]
Debiansid	pillow	`13.0.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-112400]
Debiantrixie	pillow	Not reported	AffectedDistribution reports no fix	[CVE-2026-112400]
Debiantrixie	pillow	`11.1.0-5+deb13u4`	Affected	[CVE-2026-112400]
Debiantrixie-security	pillow	`11.1.0-5+deb13u3`	Affected	[CVE-2026-112400]
Ubuntu22.04	pillow	`8.1.2+dfsg-0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1ubuntu0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1ubuntu0.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu22.04	pillow	`9.0.1-1ubuntu0.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.0.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.1.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.2.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.2.0-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.2.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.2.0-1ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu24.04	pillow	`10.2.0-1ubuntu1.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`11.3.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`11.3.0-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.0.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.1.1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.10	pillow	`12.1.1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntu26.10	pillow	`12.3.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`6.1.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`6.1.0-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`6.2.1-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.9`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow	`7.0.0-4ubuntu0.9+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow-python2	`6.2.1-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow-python2	`6.2.1-3ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow-python2	`6.2.1-3ubuntu0.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC
Ubuntupro	pillow-python2	`6.2.1-3~build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112400]Oct 28, 2026, 8:17:44 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "pillow",
      "status": "fixed",
      "release": "sid",
      "version": "13.0.0-1"
    },
    {
      "name": "pillow",
      "status": "vulnerable",
      "release": "forky",
      "version": "12.3.0-1"
    },
    {
      "name": "pillow",
      "status": "vulnerable",
      "release": "trixie",
      "version": "11.1.0-5+deb13u4"
    },
    {
      "name": "pillow",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "11.1.0-5+deb13u3"
    },
    {
      "name": "pillow",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "9.4.0-1.1+deb12u1"
    },
    {
      "name": "pillow",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "9.4.0-1.1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "13.0.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "6.1.0-1",
        "6.1.0-1build1",
        "6.2.1-2",
        "7.0.0-4",
        "7.0.0-4build1",
        "7.0.0-4ubuntu0.1",
        "7.0.0-4ubuntu0.2",
        "7.0.0-4ubuntu0.3",
        "7.0.0-4ubuntu0.4",
        "7.0.0-4ubuntu0.5",
        "7.0.0-4ubuntu0.6",
        "7.0.0-4ubuntu0.7",
        "7.0.0-4ubuntu0.8",
        "7.0.0-4ubuntu0.9",
        "7.0.0-4ubuntu0.9+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow-python2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "6.2.1-3~build1",
        "6.2.1-3",
        "6.2.1-3ubuntu0.1~esm1",
        "6.2.1-3ubuntu0.1~esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "8.1.2+dfsg-0.3",
        "9.0.0-1",
        "9.0.1-1",
        "9.0.1-1build1",
        "9.0.1-1ubuntu0.1",
        "9.0.1-1ubuntu0.2",
        "9.0.1-1ubuntu0.3",
        "9.0.1-1ubuntu0.4",
        "9.0.1-1ubuntu0.5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "10.0.0-1",
        "10.1.0-1",
        "10.2.0-1",
        "10.2.0-1build1",
        "10.2.0-1ubuntu1",
        "10.2.0-1ubuntu1.2",
        "10.2.0-1ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "12.1.1-2ubuntu1",
        "12.3.0-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "11.3.0-1ubuntu1",
        "11.3.0-1ubuntu2",
        "12.0.0-1ubuntu1",
        "12.1.1-1ubuntu1",
        "12.1.1-2ubuntu1",
        "12.1.1-2ubuntu1.1",
        "12.1.1-2ubuntu1.2",
        "12.1.1-2ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112400",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112400",
      "provider_updated_at": "2026-10-28T20:17:44.294611879Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "ranges": [
        {
          "fixed": "13.0.0",
          "introduced": "9.2.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112400",
      "fixed_version": "13.0.0",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-112400",
      "provider_updated_at": "2026-10-27T21:02:32.240"
    }
  ]
}

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

[python3-pil]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 9.4.0-1.1+deb12u1 · amd64 · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · arm64 · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · amd64 · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · arm64 · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
[python3-pil.imagetk]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 9.4.0-1.1+deb12u1 · amd64 · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · arm64 · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · amd64 · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · arm64 · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
[python-pil-doc]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 9.4.0-1.1+deb12u1 · all · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · all · bookworm
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · all · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12
- 9.4.0-1.1+deb12u1 · all · bookworm-security
  Уражена
  nvd · pillow · debian · bookworm; nvd · pillow · debian · 12

[Debian 13 (Trixie)]

[python3-pil]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 11.1.0-5+deb13u4 · amd64 · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u4 · arm64 · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · amd64 · trixie-security
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · arm64 · trixie-security
  Уражена
  nvd · pillow · debian · 13
[python3-pil.imagetk]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 11.1.0-5+deb13u4 · amd64 · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u4 · arm64 · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · amd64 · trixie-security
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · arm64 · trixie-security
  Уражена
  nvd · pillow · debian · 13
[python-pil-doc]Невідомо
Пакет джерела: [pillow]
Подробиці (4)
- 11.1.0-5+deb13u4 · all · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u4 · all · trixie
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · all · trixie-security
  Уражена
  nvd · pillow · debian · 13
- 11.1.0-5+deb13u3 · all · trixie-security
  Уражена
  nvd · pillow · debian · 13

Спостережено: Oct 27, 2026, 9:07:40 PM UTC

Посилання

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]