{"items":[{"id":"NVI-00011856","kind":"vulnerability","title":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-65qm-jvmh-6pqg","CVE-2026-112400"],"plain_summary":"GitHub lists this reviewed advisory for Pillow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-452bfebe3a6706aae567ce755487c18b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-452bfebe3a6706aae567ce755487c18b","url":"https://github.com/advisories/GHSA-65qm-jvmh-6pqg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-65qm-jvmh-6pqg","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-452bfebe3a6706aae567ce755487c18b"],"technology":"Pillow","known_exclusions":[],"conditions_summary":"```\n============================================================================\nGIF seek keeps rejected size after DecompressionBombError, allowing DoS\nLocation: src/PIL/GifImagePlugin.py:293  in GifImageFile._seek()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the \"image too large\" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after committing gigabytes, or is killed by the operating system. There is no memory corruption.\n\nThe bug is in `GifImageFile._seek()` (`src/PIL/GifImagePlugin.py:292-294`). When a frame's extent enlarges the image, the code assigns the new size to `self._size` and only then calls `Image._decompression_bomb_check()`. Nothing restor","public_affected_ranges":[">= 9.2.0, < 13.0.0"]}],"null_published_at":"2026-11-01T01:03:56.610Z","source_updated_at":"2026-10-20T20:53:38.000Z","source_disclosed_at":"2026-10-20T20:53:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:39.183Z"}],"next_cursor":null,"snapshot_revision":"42594"}