Pillow, the Python imaging library, can enter an infinite loop while determining the frame count of a MIC image when an embedded TIFF contains at least three image file directories. MicImageFile inherits TIFF traversal logic, but its tell() method reports the OLE stream index and its seek() resets TIFF frame state, so the traversal never advances. When an application with olefile installed reads n_frames or attempts to save all frames from a crafted MIC file, the non‑advancing traversal can keep a worker thread on 100 % CPU indefinitely, effectively causing a denial‐of‐service. This is an infinite‑loop vulnerability (CWE‑835) that can compromise availability of any process that imports Pillow and processes MIC files.

Python‑Pillow versions 7.2.0 through 13.0.0 are affected. The issue is present in all builds of Pillow that contain the MicImageFile class and are used together with the olefile package. Any application that loads MIC files, calls n_frames, or attempts to export all frames from a crafted MIC image is susceptible. The defect was corrected in Pillow release 13.0.0, so upgrading to that version or later removes the vulnerability.

The CVSS score of 8.2 indicates a high severity denial‑of‑service risk. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of mitigations means that a malicious MIC file supplied to a vulnerable application can drive CPU usage to 100 % and stall the process. The vulnerability is not listed in the CISA KEV catalog, yet the attack vector requires either local or remote delivery of a crafted MIC file to an application that imports Pillow. If the application processes user‑supplied files, an attacker could trigger the loop by uploading a malicious MIC image, coercing the host into a denial‑of‑service state.