A 60-byte GIF makes Pillow allocate gigabytes after a bomb error is caught

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Advisory

CVE-2026-112400

Library

Pillow, pillow on PyPI

Published

2026-10-20

Severity

not scored upstream

Affected

< 12.3.0

Fixed in

12.3.0

Reaches you

by opening a file

What triggers it

Seeking to a later frame of a crafted GIF after catching the DecompressionBombError its size raised.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

A GIF is not one of the four formats a scan can be and is refused by name before Pillow sees it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_format_a_scan_never_is

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Open with formats limited to the readers you mean to use, as open_checked does; a file of any other format is refused before Pillow sees it.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-65qm-jvmh-6pqg
• The record entry, triaged 2026-11-03, last checked 2026-11-03