{"items":[{"id":"NVI-00010745","kind":"vulnerability","title":"Pillow: TarIO negative size field causes infinite CPU-spin loop","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3j72-p6qg-6xp7","CVE-2026-96642"],"plain_summary":"GitHub lists this reviewed advisory for Pillow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-dfcc1d7c5351d20ae8c14192c0f91587"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-dfcc1d7c5351d20ae8c14192c0f91587","url":"https://github.com/advisories/GHSA-3j72-p6qg-6xp7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3j72-p6qg-6xp7","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-dfcc1d7c5351d20ae8c14192c0f91587"],"technology":"Pillow","known_exclusions":[],"conditions_summary":"### Summary\n`TarIO.__init__` does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.\n\n### Details\n`TarIO.__init__` reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header:\n\n```python\nsize = int(s[124:135], 8)\n...\nself.fh.seek((size + 511) & (~511), io.SEEK_CUR)\n```\nThere is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.\n\nThe loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.\n\n### Steps to reproduce\n\nThis uses Tests/images/hopper.tar, a normal file already in the Pillow test suite. It only changes the size field of the first header.\n\n```python\nfrom PIL import TarIO\n\nwith open(\"Tests/images/hopper.tar","public_affected_ranges":["< 13.0.0"]}],"null_published_at":"2026-10-31T22:27:12.379Z","source_updated_at":"2026-10-22T16:01:48.000Z","source_disclosed_at":"2026-10-22T16:01:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:30.906Z"}],"next_cursor":null,"snapshot_revision":"42594"}