EUVD-2026-107564
GHSA-g4qv-2jxx-769h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted PNG with repeated Exif headers
-
ExploitTrigger quadratic re-slicing in Exif.load()
-
ImpactExhaust CPU and deny image-processing service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | The target application must pass an attacker-supplied image through Pillow's EXIF parsing - specifically Image.getexif(), Image._getexif(), or ImageOps.exif_transpose() (the latter common in photo-upload auto-rotation). The malicious file is a PNG because PngImagePlugin accepts an uncapped eXIf chunk, which is then filled with many repeated six-byte 'Exif\x00\x00' headers to trigger the quadratic re-slicing in Exif.load(). No authentication or special configuration is required (PR:N), but exploitation is LIMITED to Pillow 11.0.0 through 12.x (fixed in 13.0.0) and requires that the application actually reads EXIF from untrusted images; services that never process EXIF, or that enforce strict image size limits before decoding, are not affected. |
| Impact | This is a denial-of-service issue (CWE-407, inefficient algorithmic complexity), not an information-disclosure flaw as one tag implies. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) is internally consistent with a quadratic-CPU DoS: network reachable, low complexity, no privileges, availability-only impact (VA:H) with no confidentiality or integrity effect. The UI:P (passive user interaction) reflects that a victim application must process the malicious image, which is near-automatic in photo-upload rotation pipelines. No EPSS score, CISA KEV listing, or weaponized POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis' - though the fix commit and a triggering unit test (repeated 'Exif\x00\x00' headers) are public, lowering the barrier to building a trigger. Conflicting signal to note: the 'Information Disclosure' tag contradicts the CVSS impact (VA:H only, VC:N/VI:N) and the CWE-407 classification; treat this as a DoS, not data exposure. Net: a credible, easily-triggered availability risk for any service that processes untrusted image EXIF, but severity is bounded to resource exhaustion - not code execution or data loss. |
| Exploit ScenarioDerived | An attacker uploads a PNG whose eXIf chunk is padded with many repeated six-byte 'Exif\x00\x00' headers to a web service that auto-rotates photos via ImageOps.exif_transpose() or Image.getexif(). Pillow repeatedly re-slices and re-copies the shrinking EXIF buffer, producing quadratic CPU work that stalls or exhausts the worker. No exploit is published, but the fixed-source diff and its regression test publicly demonstrate the exact trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 21, 2026
Denial of service in Pillow 11.0.0 through 12.x lets an attacker-supplied PNG file consume unbounded CPU time when the application parses its EXIF metadata. Because PngImagePlugin accepts an uncapped eXIf chunk, a file stuffed with repeated six-byte 'Exif\x00\x00' headers causes Exif.load() to make a new shrinking copy of the buffer on every loop iteration, producing quadratic work that is triggered through routine calls such as Image.getexif(), Image._getexif(), or ImageOps.exif_transpose() - the latter backing many photo-upload auto-rotation workflows. The CVSS 4.0 score is 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting a pure availability impact with no confidentiality or integrity loss; no public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix ships in 13.0.0.
Earlier versions of this analysis (1)
Unbounded Exif header replacement in Pillow releases before 13.0.0 lets remote attackers who can submit crafted images trigger a CPU-consuming loop during Exif metadata parsing, causing denial of service through stalled worker threads or exhausted processing capacity. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no memory corruption, data disclosure, or code execution, and reachability depends on an application actually parsing Exif metadata from untrusted images. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was provided.
RemediationAI
Upgrade to Pillow 13.0.0, which is the vendor-released patch for this issue and replaces the unbounded header-stripping loop in Exif.load() with a regex capped at two header repetitions (commit 806e38381c781f32bbd22f4cd026678acd40fd6c, PR #10073; release notes at https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html, advisory GHSA-g4qv-2jxx-769h). If an immediate upgrade is not possible, the actionable stopgaps are: reject or strip the PNG eXIf chunk from untrusted uploads before calling Pillow (for example, do not invoke Image.getexif(), Image._getexif(), or ImageOps.exif_transpose() on user-supplied PNGs, or pre-scan the file and discard files containing an eXIf chunk - trade-off is that legitimate rotated photos will lose camera orientation metadata); enforce strict byte-size and dimension limits on uploads before decoding and reject files whose eXIf payload is disproportionately large relative to the rest of the file (trade-off is that some large but legitimate images will be refused); and run image parsing in a worker process with hard CPU-time and wall-clock limits so a quadratic parse is killed rather than stalling the request thread (trade-off is added infrastructure complexity and the need to tune timeouts to avoid false kills on oversized legitimate images). Services that never read EXIF from untrusted images, or that cap image size before decoding, are not exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-407 (inefficient algorithmic complexity) in the EXIF loader of Python's Pillow imaging library. EXIF payloads embedded in images are conventionally prefixed with a six-byte header, b"Exif\x00\x00". Prior to 13.0.0, Exif.load() in src/PIL/Image.py stripped these headers with a loop - 'while data and data.startswith(b"Exif\x00\x00"): data = data[6:]' - and Python bytes slicing creates a fresh copy of the remaining buffer on each pass, so N repeated headers cost O(N^2) memory copies and CPU. src/PIL/PngImagePlugin.py places no cap on the size of a PNG eXIf chunk, so an attacker fully controls how many header repetitions appear and therefore how long the quadratic loop runs. The patch (commit 806e3838, PR #10073) replaces the loop with a bounded regular expression, 're.sub(b"^(Exif\x00\x00){1,2}", b"", data)', and the accompanying test asserts that a payload with more than two duplicated headers raises SyntaxError. Note that although an intelligence tag labels this 'Information Disclosure', the assessed impact is availability-only: the defect wastes CPU, it does not expose data.
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable parsing of an uploaded file (AV:N/AC:L/PR:N), a victim app must process the image (UI:R), and impact is CPU-exhaustion DoS only (A:H, C:N/I:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Blast Radius
ecosystem impact- 211 pypi packages depend on pillow (186 direct, 25 indirect)
Ecosystem-wide dependent count for version 11.0.0.
Technical POC Analysis
Quadratic algorithmic complexity in EXIF parsing, CWE-407.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Pillow, the Python imaging library embedded in most of our photo-upload and image-processing pipelines, can be driven into unbounded CPU consumption by a single crafted PNG whenever the application reads its EXIF data, which routine auto-rotation and metadata calls do automatically. Because Pillow 11.0.0 through 12.x are affected and no vendor patch is yet shipping, any internet-facing upload endpoint that accepts PNGs is a potential availability risk. Leadership should care about service degradation and cloud compute cost rather than data loss: the flaw causes no confidentiality or integrity impact, but a small number of malicious uploads could stall processing workers and cascade into customer-facing outages.
No vendor-released patch is available at time of analysis; interim mitigations are to strip or reject the eXIf chunk before parsing, enforce upload size limits, wrap getexif()/exif_transpose() calls in per-request CPU and wall-clock timeouts, process untrusted images in sandboxed or isolated workers, and rate-limit uploads per account. Vendor fix is slated for Pillow 13.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occur
Denial of service in Python Pillow 12.0.0 through 12.2.0 lets a remote attacker hang an application by supplying a craft
Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate A
Uncontrolled memory allocation in Python Pillow before 12.3.0 lets a crafted BDF font file exhaust available memory and
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger
Uncontrolled memory allocation in Python Pillow before 12.3.0 allows a maliciously crafted font file to trigger excessiv
Uncontrolled memory allocation in the Python Pillow imaging library (all versions prior to 12.3.0) allows a crafted PCF
Exploit-DB