CVE-2026-112401

Affected versions of the Pillow package are vulnerable to Inefficient Algorithmic Complexity (CWE-407) due to unbounded repeated concatenation of immutable byte strings while parsing GIF comment data. The `GifImageFile._seek()` method in `src/PIL/GifImagePlugin.py` builds `info["comment"]` by repeatedly using `comment += block` for each 255-byte sub-block and `info["comment"] += b"\n" + comment` for each comment extension, causing a full re-copy of all previously accumulated data on every append, which makes the cost of parsing grow quadratically with the amount of comment data; because `_open()` calls `self._seek(0)`, this cost is paid unconditionally inside `Image.open()` before any application logic inspects the image. An attacker can craft a small GIF file consisting of a 1×1 image with thousands of tiny comment extensions to force `Image.open()` to consume disproportionate processor time—for example, a 4 MB crafted file can take over 30 seconds to open versus a fraction of a second for an ordinary GIF of the same size—allowing a remote, unauthenticated attacker to exhaust worker processes and cause a Denial of Service in any service that opens, thumbnails, or identifies user-supplied GIF images.