CVE-2026-112399 - Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE ID :CVE-2026-112399 Published : Oct. 19, 2026, 10:17 p.m. | 1 hour, 48 minutes ago Description :Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG...