ALAS2023-2026-3441

References: CVE-2026-112401  CVE-2026-112902  CVE-2026-96640 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in Pillow. When parsing GIF images with numerous comment blocks, the library repeatedly copies data in an inefficient manner. A remote attacker can exploit this vulnerability by submitting a specially crafted GIF image to an application that processes images using Pillow, causing excessive CPU consumption and leading to a Denial of Service (DoS). (CVE-2026-112401)

A flaw was found in Pillow. When saving an image in the TIFF format, Pillow incorrectly forwards unknown metadata tags to the underlying image processing library. A remote attacker could exploit this flaw by providing a specially crafted image containing malicious metadata to an application that processes and re-saves it. Successful exploitation allows the attacker to read out-of-bounds memory, leading to the disclosure of sensitive process memory or causing the application to crash, resulting in a Denial of Service (DoS). (CVE-2026-112902)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0. (CVE-2026-96640)

Issue Correction:
Run dnf update python-pillow --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3441 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3-pillow-tk-9.4.0-2.amzn2023.0.13.aarch64
    python3-pillow-tk-debuginfo-9.4.0-2.amzn2023.0.13.aarch64
    python3-pillow-devel-9.4.0-2.amzn2023.0.13.aarch64
    python-pillow-debugsource-9.4.0-2.amzn2023.0.13.aarch64
    python-pillow-debuginfo-9.4.0-2.amzn2023.0.13.aarch64
    python3-pillow-debuginfo-9.4.0-2.amzn2023.0.13.aarch64
    python3-pillow-9.4.0-2.amzn2023.0.13.aarch64

src:
    python-pillow-9.4.0-2.amzn2023.0.13.src

x86_64:
    python-pillow-debuginfo-9.4.0-2.amzn2023.0.13.x86_64
    python-pillow-debugsource-9.4.0-2.amzn2023.0.13.x86_64
    python3-pillow-tk-debuginfo-9.4.0-2.amzn2023.0.13.x86_64
    python3-pillow-debuginfo-9.4.0-2.amzn2023.0.13.x86_64
    python3-pillow-devel-9.4.0-2.amzn2023.0.13.x86_64
    python3-pillow-tk-9.4.0-2.amzn2023.0.13.x86_64
    python3-pillow-9.4.0-2.amzn2023.0.13.x86_64