CVE-2026-96642

A flaw was found in Pillow. When an application processes tar archives using the TarIO component, an archive containing an invalid negative member size causes the parser to enter an infinite loop by repeatedly reading the same header. An attacker could exploit this by providing a specially crafted archive, leading to high CPU consumption and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because, while processing a crafted archive can trigger an infinite loop and complete CPU exhaustion, exploitation requires an application to explicitly invoke the TarIO helper class rather than standard image loading interfaces. Typical deployment workflows and default image parsing pathways do not utilize TarIO, significantly restricting exposure across Red Hat environments. The risk of denial of service is therefore confined to applications that directly consume untrusted archives via this specialized component.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.