Tetrak
GitHub ↗
Security · Pillow

A negative size in a tar header spins Pillow's TarIO for ever

Pillow: TarIO negative size field causes infinite CPU-spin loop

Advisory
CVE-2026-96642
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Opening a tar archive with PIL.TarIO.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

The carrier is a tar archive with a negative size in a member's header, opened through PIL.TarIO, which a program calls by name to read an image out of an archive. Handed to the check, a tar archive is not one of the four formats and is refused as unknown, so the record claims that refusal. Neither Tetrak OCR nor sillybos imports TarIO.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-bucketed on 2026-11-03: the file that carries the trigger is one the check refuses, so the record claims it.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Unpack archives yourself, with the standard library, and run the check on each file that comes out; a tar handed to the check is refused as unknown.

The general advice applies to every row here.

Sources