Pillow, a widely used Python imaging library, can allocate a full-size background buffer for animation PNG (APNG) frames before checking for a decompression bomb. If an attacker supplies an APNG that declares a tiny first frame, a very large canvas, and a background‑disposal operation, Pillow will create a full‑canvas memory allocation inside Image.open() even though no pixel data is processed yet. This out‑of‑bounds allocation flaw (CWE-789) can quickly exhaust the process’s memory and cause a denial‑of‑service without compromising the host system.

The flaw affects the Pillow library distributed as python-pillow:Pillow and applies to all releases from 8.1.0 up to, but not including, 13.0.0. Any application that loads PNG or APNG files—such as web image upload handlers, server‑side image converters, or desktop graphics tools—running those Pillow versions may be impacted.

The CVSS score of 8.7 indicates a high‑severity condition. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, but the lack of these metrics does not reduce the risk. Based on the description, it is inferred that the vulnerability can be triggered by supplying a crafted APNG file to any invocation of Image.open(), whether the file comes from a local upload, a network transfer, or embedded user data. Exploitation requires only the malicious file, making it relatively straightforward for an attacker with access to the input processing pipeline.