CVE-2026-112390

Affected versions of the Pillow package are vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop') due to inconsistent frame-tracking state between `MicImageFile` and its parent `TiffImageFile` class. The inherited `TiffImageFile.n_frames` property walks the embedded TIFF's IFD chain using `self._seek(self.tell() + 1)` until `_n_frames` is set, but `MicImageFile.tell()` returns the constant OLE stream index rather than the advancing TIFF directory position, while `MicImageFile.seek()` calls `TiffImageFile._open()`, which resets `_n_frames` to `None`; when the embedded TIFF stream contains three or more chained IFDs, this causes the same directory to be re-parsed endlessly without progress. An attacker can craft a small OLE2-based MIC file whose embedded TIFF stream contains three or more chained IFDs and have it opened by any application using Pillow with the optional `olefile` dependency installed; simply reading `im.n_frames` (as done when checking if an image is animated or when re-saving with `save_all=True` to TIFF, PDF, or WebP) causes the process to hang indefinitely at 100% CPU with no exception raised and no memory growth, resulting in a Denial of Service that can only be stopped by an external watchdog.