An animated PNG allocates its full canvas before the pixel limit is checked
APNG background disposal allocates the full canvas before the decompression-bomb check; a 126-byte file claiming 22,000 x 22,000 pixels costs about 1.9 GB.
- Advisory
- CVE-2026-112399 (also GHSA-5xm2-6676-qcp9)
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 8.7 out of 10, as published
- Affected
- >= 8.1.0, < 13.0.0
- Fixed in
- 13.0.0
- Reaches you
- by opening a file
What triggers it
Opening a small animated PNG whose IHDR claims enormous dimensions.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the max_pixels check.
Width and height are read from the IHDR, and the frame count from acTL, before any decoder runs; the product is held to max_pixels and the count to max_pages.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 13.0.0.
Specifically. Read the declared size from the header and refuse before the decoder allocates; sillybos does.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-5xm2-6676-qcp9
- The record entry, triaged 2026-11-01, last checked 2026-11-01