A GIF image containing a crafted frame can trigger Pillow’s decompress‑bomb detection, raising a DecompressionBombError. If the exception is caught and the same image object is used again, the library retains the rejected frame’s dimensions. Subsequent seek or load operations then allocate memory based on these oversized dimensions, potentially exhausting available memory and causing the application to become unresponsive. The weakness is reflected in CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Allocation of Resources Without Limits).

Python applications that use Pillow versions from 9.2.0 up to and including 12.9.9 are vulnerable when they allow GIFs from untrusted sources to be loaded and processed without upgrading to version 13.0.0 or later, which contains the fix.

The CVSS score of 8.7 indicates a high severity of denial‑of‑service potential. Exploitation requires delivery of a malicious GIF file to the target application; the likelihood of exploitation is uncertain due to the lack of an EPSS score, but it could be attempted by attackers with any access to provide image input. The flaw is not listed in the CISA KEV catalog, so no known widespread exploit exists at this time. The attack vector is inferred to be either local, if the attacker can supply files, or remote, if the application receives GIFs over the network.