CVE-2026-96639
published 2026-10-21CVE-2026-96639: Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.67%
51.8th percentile
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python-pillow | pillow | — | — |
| python | pillow | >= 11.0.0 < 13.0.0 | 13.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
ghsa·2026-10-22
CVE-2026-96639 [CRITICAL] CWE-125 Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
### Summary
Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame.
If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may decode wider pixels into the stale narrow native buffer. This causes native
out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented `ImageSequence.Iterator` + `frame.load()` path.
### Details
The root cause appears to be that `ImageFile.load
VulDB
python-pillow Pillow up to 12.x Multi-Frame Loaders ImageFile.load_prepare out-of-bounds write
vuldb·2026-10-21·CVSS 9.8
CVE-2026-96639 [CRITICAL] python-pillow Pillow up to 12.x Multi-Frame Loaders ImageFile.load_prepare out-of-bounds write
A vulnerability marked as critical has been reported in python-pillow Pillow up to 12.x. This affects the function ImageFile.load_prepare of the component Multi-Frame Loaders. The manipulation leads to out-of-bounds write.
This vulnerability is traded as CVE-2026-96639. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published