Vulnerabilities
Pillow 13.0.0 stops APNGs from draining gigabytes of memory via CVE-2026-112399
A crafted animated PNG could force Pillow to allocate gigabytes of memory before safety checks ran. Version 13.0.0 resolves the issue.
Memory Exhaustion
Everything Threat Times has reported about Memory Exhaustion: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Pillow GIF flaw exhausts memory after decompression bomb check in versions 9.2.0 through 12.x
A high-severity flaw in the Python Pillow library allows attackers to trigger massive memory allocation by exploiting how rejected GIF frame sizes are handled.