CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loop

Descripción

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7 Vendor Advisory
• https://github.com/python-pillow/Pillow/pull/10012 Issue Tracking
• https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d Patch
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes