Multiple security vulnerabilities have been identified in Pillow, a Python imaging library. The issues affect image parsing and processing paths, including multi-frame image handling, decompression-bomb checks, bitmap decoding, and PDF append operations, across multiple affected releases. They can allow remote attackers to cause denial of service, memory exhaustion, or native memory corruption with potential for code execution when untrusted image or PDF files are processed. The combined risk is high for services that accept and process user-supplied image files.
CVE-2026-96636 (CVSS 6.5 — Medium): Pillow's decompression-bomb protection is bypassed in multi-frame MPO and DCX image handling because frame seeking re-parses frame dimensions without rechecking the pixel limit. An attacker can supply a small multi-frame image whose later frame declares huge dimensions, causing memory exhaustion when the frame is loaded.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Pillow, a Python imaging library. The issues affect image parsing and processing paths, including multi-frame image handling, decompression-bomb checks, bitmap decoding, and PDF append operations, across multiple affected releases. They can allow remote attackers to cause denial of service, memory exhaustion, or native memory corruption with potential for code execution when untrusted image or PDF files are processed. The combined risk is high for services that accept and process user-supplied image files.
CVE-2026-96636 (CVSS 6.5 — Medium): Pillow's decompression-bomb protection is bypassed in multi-frame MPO and DCX image handling because frame seeking re-parses frame dimensions without rechecking the pixel limit. An attacker can supply a small multi-frame image whose later frame declares huge dimensions, causing memory exhaustion when the frame is loaded.[emaillocker id="1283"]
CVE-2026-55379: A similar decompression-bomb protection bypass in a font-file handling component allows a crafted font file to trigger excessive memory allocation during processing.
CVE-2026-55380: A similar decompression-bomb protection bypass in a GD image handling component allows a crafted image file to trigger excessive memory allocation during processing.
CVE-2026-40192: A similar decompression-bomb protection bypass in a FITS GZIP image handling component allows a crafted image file to trigger excessive memory allocation during processing.
CVE-2026-96637 (CVSS 7.1 — High): The Spider image plugin bypasses the decompression-bomb check when seeking between frames, allowing attacker-controlled header values to set an unchecked image size. A tiny crafted multi-frame Spider file can trigger multi-gigabyte allocation and denial of service when loaded.
CVE-2026-96638 (CVSS 6.5 — Medium): The BMP RLE decoder can be forced into unbounded memory growth through delta escape and absolute-mode branches that append data beyond the intended destination size. A small crafted BMP file can cause large memory allocation and denial of service during decoding.
CVE-2026-96639 (CVSS 9.8 — Critical): Multi-frame image loaders can reuse stale native image storage after a mode transition, causing out-of-bounds writes when a later frame uses a wider pixel mode than the retained buffer. The flaw can lead to process crashes, memory corruption, and, in some runtime profiles, command execution when crafted multi-frame images are processed.
CVE-2026-96640 (CVSS 8.2 — High): The PDF append path can accept a malformed shared page-tree structure in which repeated child references are expanded without duplicate tracking. An attacker who can supply an existing PDF to an application that appends an image can cause disproportionate CPU consumption and resource exhaustion.
These vulnerabilities collectively present a high risk of denial of service, memory exhaustion, and native memory corruption in applications that process untrusted image or PDF files. Services that accept uploads or otherwise handle user-supplied media are most at risk, especially when they iterate multi-frame images or append to existing PDF documents. The general action is to prioritize risk management for these processing paths.
We recommend you to update Pillow to version 13.0.0.
The following reports contain further technical details:
[/emaillocker]