Pillow MIC Parsing Bug: CVE-2026-112390 Causes Infinite Loop in olefile-Enabled Apps

A vulnerability in the widely used Python imaging library Pillow allows attackers to cause indefinite CPU consumption through specially crafted MIC image files. According to the National Vulnerability Database, this issue is tracked as CVE-2026-112390 and carries a CVSS score of 8.2, which rates as high severity. The flaw exists in all releases starting from version 7.2.0 and continues through versions prior to the fixed release of 13.0.0.

The risk

The core problem lies in how Pillow handles the frame count determination for MIC image files. The library's MicImageFile class inherits frame traversal logic from its TIFF handling components. However, the internal methods for reporting stream indices and resetting frame states do not align correctly when an embedded TIFF contains at least three Image File Directories. This mismatch causes the traversal process to fail to advance, trapping the reading process in an infinite loop.

Who is exposed

Any application using Pillow versions between 7.2.0 and 13.0.0 is potentially exposed to this resource exhaustion vector. The risk is significantly elevated for environments where the olefile library is also installed and used in conjunction with Pillow. When such an application attempts to read the number of frames or save all frames from a malicious MIC file, the non-advancing traversal holds a worker thread at full CPU capacity indefinitely, leading to service degradation or denial of service.

Cost and compliance

The National Vulnerability Database rates the severity of CVE-2026-112390 as high based on a CVSS score of 8.2. The weakness is classified under CWE-835, which relates to improper resource management. No specific financial impact figures or regulatory compliance mandates are provided in the source material, but the potential for complete worker thread exhaustion represents a significant operational risk for services relying on continuous image processing capabilities.

What to watch

Security teams should verify the specific version of the Pillow library deployed in their Python environments. Identifying applications that process untrusted MIC image files is critical, as these are the primary vectors for triggering the infinite loop. Monitoring for processes that suddenly consume excessive CPU resources without corresponding increases in legitimate image processing volume can help identify early signs of exploitation or accidental triggering of this flaw.

Signals worth monitoring

Teams usually detect this type of resource exhaustion by monitoring for worker processes that maintain near-maximum CPU utilization for extended periods without producing output. Check whether application logs show repeated attempts to open or parse specific image files that never complete successfully. Look for alerts indicating thread starvation or delayed response times in services that handle image uploads. Containment moves typically involve isolating the affected service instance and reviewing the input sources for malformed image files that may be triggering the infinite loop behavior.

What to do and how to stay safe: Pillow

• Audit your Python dependencies to confirm whether Pillow version 13.0.0 is installed, as this release resolves the infinite loop issue.
• Identify services that accept MIC image uploads and ensure they validate file integrity before passing them to the imaging library.
• Monitor system resource usage for Python processes to detect sudden, sustained spikes in CPU consumption that indicate a hung worker thread.
• Review integration points with the olefile library, as its presence increases the likelihood of this specific traversal failure occurring.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are vulnerable to CVE-2026-112390?

Versions from 7.2.0 up to but not including 13.0.0 are affected by this infinite loop vulnerability.

What is the CVSS severity rating for this flaw?

The National Vulnerability Database assigns a CVSS score of 8.2, which is considered high severity.

Is there a fix available for this issue?

Yes, the issue is fixed in version 13.0.0 of the Pillow library.