The vulnerability in the Pillow imaging library allows an attacker who can provide a specially crafted tar archive to the TarIO initializer to trigger an infinite CPU‑spinning loop. The bug arises when a tar file header contains a negative octal size field. This causes a backward seek that returns to the same 512‑byte header and, because the member name does not match, the parser repeatedly reads that header. The loop consumes the entire CPU core and never terminates, resulting in a denial of service. The weakness is classified as CWE‑835, an infinite loop leading to resource exhaustion.

The affected vendor is Python Pillow, versions older than 13.0.0. The library product is Pillow. Any deployment using versions older than 13.0.0 that directly invokes PIL.TarIO rather than the standard Image.open() path is susceptible. No additional product versions are listed in the CNA data.

The CVSS score of 7.1 indicates a high impact vulnerability, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no known exploitation activity. The primary attack vector requires local code that explicitly uses PIL.TarIO.TarIO; it is not a remote network‑exposed flaw. An attacker who can supply a malicious tar file programmatically to the vulnerable code will cause the application to consume 100 % of a CPU core indefinitely, potentially affecting all processes on the system. Because the exploit requires direct use of the library rather than typical image opening, the immediate risk is limited to applications that have incorporated this specific code path.