CVE-2026-112399

Affected versions of the Pillow package are vulnerable to Memory Allocation with Excessive Size Value due to allocating a disposal buffer sized from attacker-controlled image header dimensions before the decompression bomb check executes. The `PngImageFile._seek()` method, invoked from `_open()` when an `fcTL` chunk requests `OP_BACKGROUND` (or `OP_PREVIOUS` on frame 0, which is rewritten to `OP_BACKGROUND`) disposal, calls `Image.core.fill(self.mode, self.size)` using the full IHDR-declared width and height, allocating and zero-filling the entire canvas inside the plugin factory, which runs before `Image.open()`'s `_decompression_bomb_check(im.size)` is reached. An attacker can craft a small, well-formed APNG file (as little as 126 bytes) declaring extreme IHDR dimensions with a minimal `fcTL` frame rectangle to make any application that calls `Image.open()` on untrusted input allocate and write multiple gigabytes of memory per file with no further calls such as `load()` required, causing severe memory exhaustion or an operating-system out-of-memory kill of the process, and sustained or concurrent exploitation can degrade or crash services accepting image uploads.