CVE-2026-112399

{
  "etk_id": "ETK-2026-2106",
  "cve_id": "CVE-2026-112399",
  "display_id": "CVE-2026-112399",
  "ghsa_id": "GHSA-5xm2-6676-qcp9",
  "euvd_id": "EUVD-2026-104635",
  "status": "published",
  "anchor_state": "anchored",
  "title": "APNG memory exhaustion in Pillow",
  "summary": "Pillow versions 8.1.0 through 12.x can consume excessive memory when opening a specially formed APNG image. An attacker who can cause an application to process an untrusted APNG may deny service by exhausting memory, even if the application only opens the image.",
  "mitigation": "Upgrade Pillow to version 13.0.0 or later. Until upgraded, do not process untrusted APNG files in services with limited memory.",
  "vendor": "python-pillow",
  "product": "Pillow",
  "affected": [
    {
      "affected_notes": [
        "8.1.0 - 12.3.0"
      ],
      "affected_ranges": [],
      "ecosystem": "pip",
      "fixed_versions": [
        "13.0.0"
      ],
      "package_name": "Pillow",
      "purl": "pkg:pypi/Pillow"
    }
  ],
  "cwes": [
    789
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0029,
  "epss_percentile": 0.2042,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.0106869,
  "t0_at": "2026-10-19T21:10:11.266000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T21:10:11.266000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T21:10:11.266000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112399"
    }
  }
}