Threats tagged 'bit-pillow-2026-96642'

Pillow versions prior to 13.0.0 contain a vulnerability in the TarIO initializer where a negative octal member size causes an infinite CPU spin loop. This occurs because the code computes a backward seek that returns to the same 512-byte header repeatedly when the requested member name does not match, leading to high CPU consumption. This issue only affects applications that directly use PIL.TarIO.TarIO instead of the default Image.open() method. The vulnerability is fixed in Pillow version 13.0.0.