CVE-2026-96641
published 2026-10-21CVE-2026-96641: Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.35%
28.4th percentile
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result. Applications that use getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations can experience logic-integrity errors or resource consumption, while the high-level mask path commonly retains a decompression-bomb check. This issue is fixed in version 13.0.0.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
ghsa·2026-10-22
CVE-2026-96641 [MEDIUM] CWE-190 Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
### Summary
Affected Object and Source
Package: Pillow 12.3.0
Source: PyPI sdist pillow-12.3.0.tar.gz
SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
Sink: src/_imaging.c:2809:15, xsize += dx
### Details
The code in Pillow 12.3.0 is:
```c
for (xsize = 0; *text; text++) {
int dx = self->glyphs[*text].dx;
if (dx > 0 && xsize > INT_MAX - dx) {
PyErr_SetString(PyExc_OverflowError, "Width too large");
return -1;
}
xsize += dx;
}
```
The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves:
`dx > 0 => xsize xsize >= INT_MIN - dx`
Taking `dx = -3
VulDB
python-pillow Pillow up to 12.x PILfont src/_imaging.c integer overflow
vuldb·2026-10-21·CVSS 6.5
CVE-2026-96641 [MEDIUM] python-pillow Pillow up to 12.x PILfont src/_imaging.c integer overflow
A vulnerability classified as problematic has been found in python-pillow Pillow up to 12.x. Affected by this issue is some unknown functionality of the file src/_imaging.c of the component PILfont. The manipulation leads to integer overflow.
This vulnerability is uniquely identified as CVE-2026-96641. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
Red Hat
pillow: pillow: Denial of Service via integer overflow in text-width calculation
vendor_redhat·2026-10-21·CVSS 6.5
CVE-2026-96641 [MEDIUM] CWE-190 pillow: pillow: Denial of Service via integer overflow in text-width calculation
pillow: pillow: Denial of Service via integer overflow in text-width calculation
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result. Applications that use getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations can experience logic-integrity errors or resource consumption, while the high-level mask path commonly retains a decompression-bomb check. This issue is fixed in version 13.0.0.
A flaw was found in Pillow. When processi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published