CVE-2026-96642 python-pillow CVE debrief

Who should care

Defenders responsible for systems using Pillow, especially those processing tar files, should assess exposure and prioritize updates to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-96642 is a vulnerability in Pillow's TarIO class that can cause an infinite CPU loop when processing tar files with negative size fields. Defenders should prioritize verifying and updating Pillow versions to prevent potential denial-of-service attacks.

• Denial of service due to infinite CPU loop
• Potential for exploitation through crafted tar files
• Need for verification of Pillow version and exposure
• Priority for updating to version 13.0.0 or later

Technical summary

The TarIO class in Pillow does not check if a tar header's size field is positive. A crafted header with a negative size field causes TarIO to seek backward onto itself, resulting in an infinite loop that consumes 100% CPU. This issue affects Pillow versions prior to 13.0.0. The vulnerability is caused by the lack of a positive check for the size field in tar headers. A negative size field can cause TarIO to loop infinitely. Defenders should prioritize verifying and updating Pillow versions to 13.0.0 or later, reviewing systems using affected versions for potential exposure, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and updating Pillow versions to 13.0.0 or later, reviewing systems using affected versions for potential exposure, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update Pillow to version 13.0.0 or later
• Review systems using affected Pillow versions for potential exposure
• Monitor for suspicious activity related to tar file processing
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by the lack of a positive check for the size field in tar headers. A negative size field can cause TarIO to loop infinitely. This issue affects Pillow versions prior to 13.0.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.