Search: CVE-2026-112401

CVE-2026-112401 is an inefficient algorithmic complexity vulnerability in the python-pillow Pillow library affecting GIF comment processing. The flaw causes Image.open() to consume CPU time quadratically relative to the size of crafted GIF comment extensions, leading to denial-of-service (DoS) via processor exhaustion. This occurs because the code repeatedly concatenates immutable bytes objects without size limits, causing excessive copying. The issue affects Pillow versions from 5.4.0 up to but not including 13.0.0 and was fixed in version 13.0.0.