CVE-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

What is CVE-2026-112390?

CVE-2026-112390 is a high-severity vulnerability in Python Pillow, published on 19 Oct 2026.

Official description

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.

Weakness: CWE-835

Which versions are affected by CVE-2026-112390?

3 open source packages ship an affected version, including pillow and Pillow. It affects 1 product.

Products include Python Pillow.

How do I fix CVE-2026-112390?

Upgrade pillow to 13.0.0 or later.

Is CVE-2026-112390 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112390 exists.

Other vulnerabilities in Python Pillow

• CVE-2014-3007 Pillow command injection Critical 10.0
• CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions Critical 9.8
• CVE-2022-30595 Buffer over-flow in Pillow Critical 9.8
• CVE-2021-25289 Out of bounds write in Pillow Critical 9.8
• CVE-2016-4009 Pillow Integer overflow in ImagingResampleHorizontal Critical 9.8

All Python Pillow vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-pillow-2026-112390, DEBIAN-CVE-2026-112390, ECHO-1372-62ab-2170, GHSA-22hg-r758-rrw9, ROOT-APP-PYPI-CVE-2026-112390, UBUNTU-CVE-2026-112390.