Security · Pillow
A MIC file makes counting its frames loop for ever
Infinite loop in MIC n_frames when the embedded TIFF has three or more directories; needs the optional olefile package.
- Advisory
- CVE-2026-112390 (also GHSA-22hg-r758-rrw9)
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 8.2 out of 10, as published
- Affected
- >= 7.2.0, < 13.0.0
- Fixed in
- 13.0.0
- Reaches you
- by opening a file
What triggers it
Opening a crafted MIC (Microsoft Image Composer) file, an OLE container, and reading n_frames.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the formats check.
OLE is refused by name from the first bytes.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 13.0.0. Do not install olefile where it is not needed.
Specifically. formats=[...] on Image.open, or sillybos in front of it.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-22hg-r758-rrw9
- The record entry, triaged 2026-11-01, last checked 2026-11-01