Pillow CVE-2026-96642

Exploitation requires that the target application directly invoke PIL.TarIO.TarIO on an attacker-controlled TAR archive - the default Image.open() code path does NOT reach this parser and is unaffected. The malicious archive must contain a tar header with a negative octal member size (e.g. '-1') for a member whose name does not match the requested file, which drives the backward seek back onto the same 512-byte header. The decisive limiting factor is this non-default API usage: only applications that deliberately use the legacy TarIO interface on untrusted input are exposed, which dramatically narrows the real attack surface despite the network-reachable CVSS vector. A further limiter is UI:P - a user or service must supply/process the crafted archive. Affected: all Pillow versions prior to 13.0.0.

This is a CWE-835 uncontrolled-loop denial of service in Pillow's legacy TarIO parser, and the raw CVSS 4.0 score of 7.1 overstates its real-world priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly shows an availability-only impact with no confidentiality or integrity loss - this cannot be used for code execution or data theft, only to hang a process by pinning one CPU core. The single most important mitigating signal is NOT in the CVSS vector: the description states TarIO is reached ONLY when an application directly calls PIL.TarIO.TarIO, never via the default Image.open() path, so the vast majority of Pillow deployments are not exposed at all. No EPSS score, KEV listing, or public POC was provided in the input; a regression test accompanies the fix commit but a standalone weaponized exploit is not referenced. Net assessment: genuinely patch-worthy for the narrow set of applications that use the TarIO API on untrusted archives, but a low operational priority for the typical Pillow user. Conflicting signal to verify: CVSS marks AV:N/PR:N/UI:P (network, unauthenticated, passive interaction), yet exploitation depends on a non-default code path the operator must have chosen to use - a deployment precondition CVSS does not capture.

An application that accepts user-uploaded TAR archives and opens image members by calling PIL.TarIO.TarIO directly is given a crafted archive whose header encodes a negative octal member size for a member name that does not match the requested one. The parser computes a backward seek back to the same 512-byte header and re-reads it forever, consuming a full CPU core and never returning, hanging the worker. No public exploit is identified at time of analysis, though the fix commit includes a regression test demonstrating the condition.