Pillow’s SpiderImageFile.seek() function can reinterpret a later frame in a SPIDER image and set the reported size without re‑executing the decompression‑bomb check. A malicious image can first pass validation with a small safe frame, then declare an enormous width and height in a later frame. When that oversized frame is decoded, Pillow allocates roughly four bytes for each declared pixel, allowing an attacker to consume multiple gigabytes of memory and trigger a memory‑exhaustion DoS. The underlying weakness is reflected in CWE-400 and CWE-409.

All Python Pillow installations prior to version 13.0.0 are affected. This includes every Pillow release distributed before the 13.0.0 tag; no specific sub‑versions are listed in the advisory beyond the overall cutoff.

The CVSS score of 7.1 indicates a high impact. The exploit probability (EPSS) is not available, and the vulnerability is not in CISA’s KEV catalog. Exploitation requires the attacker to supply a crafted image file to any application that imports or uses Pillow to open or process files. The attack vector is therefore likely remote in contexts where untrusted images are handled, such as web applications or email clients that use Pillow. Once the malicious frame is processed, the program will consume a large amount of memory and eventually fail, causing a service outage.