PYSEC-2026-3452

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-3452.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-3452

Aliases

Published

2026-07-14T16:17:02.063Z

Modified

2026-07-15T20:11:27.953713427Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.

References

Affected packages

PyPI / pillow

Package

Name: pillow; View open source insights on deps.dev
Purl: pkg:pypi/pillow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12.0.0

Fixed

12.3.0

Affected versions

12.*

12.0.0

12.1.0

12.1.1

12.2.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-3452.yaml"