Every CVESearch/Get API key

CVE-2026-96637

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

7.1 HighFix available

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Unchanged since Oct 22, 2026
90%50%10%1%

What each source reports

CVE List Score used7.1

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
CVE-2026-96637
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-409
Updated
2026-11-02
EUVDEUVD-2026-1075697.1

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
EUVD-2026-107569
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g842-9rc4-69pw7.1

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary

SpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny (<1KB) crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load().

Affected versions

All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)

Root cause

Image.open() runs Image._decompression_bomb_check(im.size) exactly once, in _open_core (src/PIL/Image.py:3668), right after the initial _open().

SPIDER stack files are multi-frame: SpiderImageFile.seek(frame) (SpiderImagePlugin.py:179-190) computes an attacker-influenced stkoffset and calls self._open() AGAIN directly (line 190) — NOT through Image.open(). _open() re-parses a fresh 27-float header at that offset and reassigns:

self._size = int(h[12]), int(h[2])      # SpiderImagePlugin.py:131

straight from unvalidated header floats (isSpiderHeader only checks internal labrec*lenbyt==labbyt consistency, never bounds nsam/nrow). No bomb check runs on this new size.

On the subsequent load(), ImageFile.load_prepare() (ImageFile.py:436-437) executes self.im = Image.core.new(self.mode, self.size) with the unchecked, attacker-chosen size. Mode is always "F" (4 bytes/pixel), so e.g. 40000x40000 = 6.4 GB.

Why this is a real bug

Sibling multi-frame plugins DO re-check on their alternate paths:

  • GifImagePlugin.py:286 - Image._decompression_bomb_check(self._size) (in seek)
  • TiffImagePlugin.py:1309 - Image._decompression_bomb_check(self._tile_size)
  • IcnsImagePlugin.py:121/138, IcoImagePlugin.py:236/240 (sub-image selection)

SpiderImagePlugin has NO bomb check anywhere. This is the same class of bug just fixed for GdImageFile (GHSA-phj9-mv4w-65pm) and the FontFile classes (GHSA-5x94/8v84/45hq): an allocation reached on a non-Image.open() path sized by an attacker header field, independent of the one-time pixel bomb check.

Reproduction

Python 3.13, Pillow HEAD e7a7ea84

Attached: pillow_poc_spider_bomb.py

Sets Image.MAX_IMAGE_PIXELS=5000, then:

  • CONTROL: Image.open(standalone 100x100 SPIDER) -> DecompressionBombWarning fires correctly.
  • BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed.

Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.

Suggested fix

Call Image._decompression_bomb_check(self.size) at the end of SpiderImageFile._open() (or in seek() after _open()), mirroring GifImagePlugin / TiffImagePlugin. Optionally validate nsam/nrow are positive and sane in _open().

Credit: Yazan Balawneh - CyStack Security Team pillow_poc_spider_bomb.py

Record
GHSA-g842-9rc4-69pw
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-409
Updated
2026-11-02
NVD7.1

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
CVE-2026-96637
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-409
Updated
2026-11-02
OSV7.1

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
CVE-2026-96637
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-409
Updated
2026-11-11
OSVDEBIAN-CVE-2026-966376.5

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
DEBIAN-CVE-2026-96637
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-g842-9rc4-69pw7.1

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary

SpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny (<1KB) crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load().

Affected versions

All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)

Root cause

Image.open() runs Image._decompression_bomb_check(im.size) exactly once, in _open_core (src/PIL/Image.py:3668), right after the initial _open().

SPIDER stack files are multi-frame: SpiderImageFile.seek(frame) (SpiderImagePlugin.py:179-190) computes an attacker-influenced stkoffset and calls self._open() AGAIN directly (line 190) — NOT through Image.open(). _open() re-parses a fresh 27-float header at that offset and reassigns:

self._size = int(h[12]), int(h[2])      # SpiderImagePlugin.py:131

straight from unvalidated header floats (isSpiderHeader only checks internal labrec*lenbyt==labbyt consistency, never bounds nsam/nrow). No bomb check runs on this new size.

On the subsequent load(), ImageFile.load_prepare() (ImageFile.py:436-437) executes self.im = Image.core.new(self.mode, self.size) with the unchecked, attacker-chosen size. Mode is always "F" (4 bytes/pixel), so e.g. 40000x40000 = 6.4 GB.

Why this is a real bug

Sibling multi-frame plugins DO re-check on their alternate paths:

  • GifImagePlugin.py:286 - Image._decompression_bomb_check(self._size) (in seek)
  • TiffImagePlugin.py:1309 - Image._decompression_bomb_check(self._tile_size)
  • IcnsImagePlugin.py:121/138, IcoImagePlugin.py:236/240 (sub-image selection)

SpiderImagePlugin has NO bomb check anywhere. This is the same class of bug just fixed for GdImageFile (GHSA-phj9-mv4w-65pm) and the FontFile classes (GHSA-5x94/8v84/45hq): an allocation reached on a non-Image.open() path sized by an attacker header field, independent of the one-time pixel bomb check.

Reproduction

Python 3.13, Pillow HEAD e7a7ea84

Attached: pillow_poc_spider_bomb.py

Sets Image.MAX_IMAGE_PIXELS=5000, then:

  • CONTROL: Image.open(standalone 100x100 SPIDER) -> DecompressionBombWarning fires correctly.
  • BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed.

Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.

Suggested fix

Call Image._decompression_bomb_check(self.size) at the end of SpiderImageFile._open() (or in seek() after _open()), mirroring GifImagePlugin / TiffImagePlugin. Optionally validate nsam/nrow are positive and sane in _open().

Credit: Yazan Balawneh - CyStack Security Team pillow_poc_spider_bomb.py

Record
GHSA-g842-9rc4-69pw
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-409
Updated
2026-11-02
OSVPYSEC-2026-43386.5

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
PYSEC-2026-4338
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-966377.1

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
UBUNTU-CVE-2026-96637
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVBIT-pillow-2026-96637No score

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Record
BIT-pillow-2026-96637
Updated
2026-11-02
OSVCLSA-2026-1792743656No score

TuxCare security update for pillow (6 CVEs)

TuxCare rebuilt pillow to address 6 CVEs. Fixed in 11.3.0.post9+tuxcare.

Record
CLSA-2026-1792743656
Updated
2026-11-02
OSVCLSA-2026-1792752131No score

TuxCare security update for pillow (6 CVEs)

TuxCare rebuilt pillow to address 6 CVEs. Fixed in 11.2.1.post11+tuxcare.

Record
CLSA-2026-1792752131
Updated
2026-11-02
OSVCLSA-2026-1793013873No score

TuxCare security update for pillow (3 CVEs)

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 10.4.0.post14+tuxcare.

Record
CLSA-2026-1793013873
Updated
2026-11-02
OSVCLSA-2026-1793017906No score

TuxCare security update for pillow (3 CVEs)

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 9.5.0.post12+tuxcare.

Record
CLSA-2026-1793017906
Updated
2026-11-02
OSVCLSA-2026-1793085886No score

TuxCare security update for pillow (2 CVEs)

TuxCare rebuilt pillow to address 2 CVEs. Fixed in 9.4.0.post13+tuxcare.

Record
CLSA-2026-1793085886
Updated
2026-11-02
OSVCLSA-2026-1793270155No score

TuxCare security update for pillow (2 CVEs)

TuxCare rebuilt pillow to address 2 CVEs. Fixed in 8.4.0.post12+tuxcare.

Record
CLSA-2026-1793270155
Updated
2026-11-02
OSVopenSUSE-SU-2026:22246-1No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802).
  • CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801).
  • CVE-2026-96638: BMP RLE decoder memory-amplification DoS via unbounded delta escape/absolute mode (bsc#1286800).
  • CVE-2026-96639: multi-frame loaders can reuse stale native image storage after mode transitions (bsc#1286799).
  • CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).
  • CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797).
  • CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796).
  • CVE-2026-96643: PNG eXIf chunk makes EXIF parsing run in quadratic time (bsc#1286795).
  • CVE-2026-96778: heap buffer overflow writing JPEG comment after ICC profile fills buffer (bsc#1286793).
  • CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).
  • CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).
  • CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).
  • CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325).
  • CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).
  • CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (bsc#1286312).
  • CVE-2026-112396: heap use-after-free when encoding TIFF to an in-memory buffer (bsc#1286313).
  • CVE-2026-112397: out-of-bounds access in _imagingmorph on a zero-width image (bsc#1286314).
  • CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).
  • CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).
  • CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).
  • CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).
  • CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).
  • CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405).
  • CVE-2026-112404: Denial of Service via out-of-bounds read in TIFF decoding (bsc#1286388).
  • CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404).
  • CVE-2026-112406: infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (bsc#1286403).
  • CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).
  • CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).
  • CVE-2026-112893: Denial of Service via invalid pointer free during font rendering (bsc#1286392).
  • CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).
  • CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).
  • CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).
  • CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).
  • CVE-2026-112898: Image.quantize() with empty palette can leak uninitialized stack memory (bsc#1286399).
  • CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489).
  • CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).
  • CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396).
  • CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).
  • CVE-2026-114501: Arrow export leaks stale heap…
Record
openSUSE-SU-2026:22246-1
Updated
2026-11-11
OSVSUSE-SU-2026:24656-1No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802).
  • CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801).
  • CVE-2026-96638: BMP RLE decoder memory-amplification DoS via unbounded delta escape/absolute mode (bsc#1286800).
  • CVE-2026-96639: multi-frame loaders can reuse stale native image storage after mode transitions (bsc#1286799).
  • CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).
  • CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797).
  • CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796).
  • CVE-2026-96643: PNG eXIf chunk makes EXIF parsing run in quadratic time (bsc#1286795).
  • CVE-2026-96778: heap buffer overflow writing JPEG comment after ICC profile fills buffer (bsc#1286793).
  • CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).
  • CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).
  • CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).
  • CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325).
  • CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).
  • CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (bsc#1286312).
  • CVE-2026-112396: heap use-after-free when encoding TIFF to an in-memory buffer (bsc#1286313).
  • CVE-2026-112397: out-of-bounds access in _imagingmorph on a zero-width image (bsc#1286314).
  • CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).
  • CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).
  • CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).
  • CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).
  • CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).
  • CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405).
  • CVE-2026-112404: Denial of Service via out-of-bounds read in TIFF decoding (bsc#1286388).
  • CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404).
  • CVE-2026-112406: infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (bsc#1286403).
  • CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).
  • CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).
  • CVE-2026-112893: Denial of Service via invalid pointer free during font rendering (bsc#1286392).
  • CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).
  • CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).
  • CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).
  • CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).
  • CVE-2026-112898: Image.quantize() with empty palette can leak uninitialized stack memory (bsc#1286399).
  • CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489).
  • CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).
  • CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396).
  • CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).
  • CVE-2026-114501: Arrow export leaks stale heap…
Record
SUSE-SU-2026:24656-1
Updated
2026-11-12
OSVSUSE-SU-2026:5038-1No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802).
  • CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801).
  • CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).
  • CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797).
  • CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796).
  • CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).
  • CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).
  • CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).
  • CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325).
  • CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).
  • CVE-2026-112397: out-of-bounds access in _imagingmorph on a zero-width image (bsc#1286314).
  • CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).
  • CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).
  • CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).
  • CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).
  • CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).
  • CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405).
  • CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404).
  • CVE-2026-112406: infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (bsc#1286403).
  • CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).
  • CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).
  • CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).
  • CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).
  • CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).
  • CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).
  • CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489).
  • CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).
  • CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396).
  • CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).
Record
SUSE-SU-2026:5038-1
Updated
2026-11-03
OSVSUSE-SU-2026:5194-1No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802).
  • CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801).
  • CVE-2026-96638: BMP RLE decoder memory-amplification DoS via unbounded delta escape/absolute mode (bsc#1286800).
  • CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).
  • CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797).
  • CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796).
  • CVE-2026-96778: heap buffer overflow writing JPEG comment after ICC profile fills buffer (bsc#1286793).
  • CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).
  • CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).
  • CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).
  • CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325).
  • CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).
  • CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (bsc#1286312).
  • CVE-2026-112397: out-of-bounds access in _imagingmorph on a zero-width image (bsc#1286314).
  • CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).
  • CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).
  • CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).
  • CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).
  • CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).
  • CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405).
  • CVE-2026-112404: Denial of Service via out-of-bounds read in TIFF decoding (bsc#1286388).
  • CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404).
  • CVE-2026-112406: infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (bsc#1286403).
  • CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).
  • CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).
  • CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).
  • CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).
  • CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).
  • CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).
  • CVE-2026-112898: Image.quantize() with empty palette can leak uninitialized stack memory (bsc#1286399).
  • CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489).
  • CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).
  • CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396).
  • CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).
Record
SUSE-SU-2026:5194-1
Updated
2026-11-12

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
before 13.0.0
13.0.0
pillow
Bitnami
before 13.0.0
13.0.0
pillow
TuxCare:PyPI
From an advisory covering 6 CVEs
11.3.0 up to 11.3.0.post9+tuxcare, plus listed versions
11.3.0.post1+tuxcare11.3.0.post2+tuxcare11.3.0.post3+tuxcare11.3.0.post4+tuxcare11.3.0.post5+tuxcare11.3.0.post6+tuxcare11.3.0.post7+tuxcare11.3.0.post8+tuxcare
11.3.0.post9+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 6 CVEs
11.2.1 up to 11.2.1.post11+tuxcare, plus listed versions
11.2.1.post1+tuxcare11.2.1.post10+tuxcare11.2.1.post2+tuxcare11.2.1.post3+tuxcare11.2.1.post4+tuxcare
Show 5 moreShow less
11.2.1.post5+tuxcare11.2.1.post6+tuxcare11.2.1.post7+tuxcare11.2.1.post8+tuxcare11.2.1.post9+tuxcare
11.2.1.post11+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 3 CVEs
10.4.0 up to 10.4.0.post14+tuxcare, plus listed versions
10.4.0.post1+tuxcare10.4.0.post10+tuxcare10.4.0.post11+tuxcare10.4.0.post12+tuxcare10.4.0.post13+tuxcare
Show 8 moreShow less
10.4.0.post2+tuxcare10.4.0.post3+tuxcare10.4.0.post4+tuxcare10.4.0.post5+tuxcare10.4.0.post6+tuxcare10.4.0.post7+tuxcare10.4.0.post8+tuxcare10.4.0.post9+tuxcare
10.4.0.post14+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 3 CVEs
9.5.0 up to 9.5.0.post12+tuxcare, plus listed versions
9.5.0.post1+tuxcare9.5.0.post10+tuxcare9.5.0.post11+tuxcare9.5.0.post2+tuxcare9.5.0.post3+tuxcare
Show 6 moreShow less
9.5.0.post4+tuxcare9.5.0.post5+tuxcare9.5.0.post6+tuxcare9.5.0.post7+tuxcare9.5.0.post8+tuxcare9.5.0.post9+tuxcare
9.5.0.post12+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 2 CVEs
9.4.0 up to 9.4.0.post13+tuxcare, plus listed versions
9.4.0.post1+tuxcare9.4.0.post10+tuxcare9.4.0.post11+tuxcare9.4.0.post12+tuxcare9.4.0.post2+tuxcare
Show 7 moreShow less
9.4.0.post3+tuxcare9.4.0.post4+tuxcare9.4.0.post5+tuxcare9.4.0.post6+tuxcare9.4.0.post7+tuxcare9.4.0.post8+tuxcare9.4.0.post9+tuxcare
9.4.0.post13+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 2 CVEs
8.4.0 up to 8.4.0.post12+tuxcare, plus listed versions
8.4.0.post1+tuxcare8.4.0.post10+tuxcare8.4.0.post11+tuxcare8.4.0.post2+tuxcare8.4.0.post3+tuxcare
Show 6 moreShow less
8.4.0.post4+tuxcare8.4.0.post5+tuxcare8.4.0.post6+tuxcare8.4.0.post7+tuxcare8.4.0.post8+tuxcare8.4.0.post9+tuxcare
8.4.0.post12+tuxcare
pillow
Debian:12
All versions, plus listed versions
10.0.0-110.1.0-110.2.0-110.3.0-110.3.0-2
Show 19 moreShow less
10.4.0-110.4.0-1.111.1.0-111.1.0-211.1.0-311.1.0-411.1.0-511.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-212.2.0-112.3.0-113.0.0-19.4.0-1.19.4.0-1.1+deb12u19.5.0-1
None known
pillow
Debian:13
All versions, plus listed versions
11.1.0-511.1.0-5+deb13u111.1.0-5+deb13u211.1.0-5+deb13u311.1.0-5+deb13u4
Show 9 moreShow less
11.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-212.2.0-112.3.0-113.0.0-1
None known
Show 25 moreShow less
Affected packages
PackageAffectedFixed
pillow
Debian:14
All versions, plus listed versions
11.1.0-511.2.1-111.3.0-112.0.0-112.1.0-1
Show 5 moreShow less
12.1.1-112.1.1-212.2.0-112.3.0-113.0.0-1
None known
pillow
PyPI
before 13.0.0, plus listed versions
1.01.11.21.31.4
Show 45 moreShow less
1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.810.0.010.0.110.1.010.2.010.3.010.4.011.0.011.1.011.2.111.3.012.0.012.1.012.1.112.2.012.3.02.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.1
13.0.0
python-Pillow
SUSE:Linux Enterprise Server 16.0
From an advisory covering 39 CVEs
before 11.3.0-160000.9.1
11.3.0-160000.9.1
python-Pillow
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 39 CVEs
before 11.3.0-160000.9.1
11.3.0-160000.9.1
python-Pillow
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 29 CVEs
before 7.2.0-150300.3.33.1
7.2.0-150300.3.33.1
python-Pillow
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
python-Pillow
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
before 9.5.0-150400.5.28.1
9.5.0-150400.5.28.1
pillow
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
2.9.0-13.0.0-13.0.0-1build13.1.0-13.1.1-1
Show 10 moreShow less
3.1.2-0ubuntu13.1.2-0ubuntu1.13.1.2-0ubuntu1.33.1.2-0ubuntu1.43.1.2-0ubuntu1.53.1.2-0ubuntu1.63.1.2-0ubuntu1.6+esm13.1.2-0ubuntu1.6+esm23.1.2-0ubuntu1.6+esm33.1.2-0ubuntu1.6+esm4
None known
pillow
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
4.1.1-3build24.3.0-2ubuntu15.0.0-15.1.0-15.1.0-1ubuntu0.2
Show 9 moreShow less
5.1.0-1ubuntu0.35.1.0-1ubuntu0.45.1.0-1ubuntu0.55.1.0-1ubuntu0.65.1.0-1ubuntu0.75.1.0-1ubuntu0.85.1.0-1ubuntu0.8+esm15.1.0-1ubuntu0.8+esm25.1.0-1ubuntu0.8+esm3
None known
pillow
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1
Show 11 moreShow less
7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.47.0.0-4ubuntu0.57.0.0-4ubuntu0.67.0.0-4ubuntu0.77.0.0-4ubuntu0.87.0.0-4ubuntu0.97.0.0-4ubuntu0.9+esm17.0.0-4ubuntu0.9+esm2
None known
pillow-python2
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
6.2.1-3~build16.2.1-36.2.1-3ubuntu0.1~esm16.2.1-3ubuntu0.1~esm2
None known
pillow
Ubuntu:22.04:LTS
All versions, plus listed versions
8.1.2+dfsg-0.39.0.0-19.0.1-19.0.1-1build19.0.1-1ubuntu0.1
Show 6 moreShow less
9.0.1-1ubuntu0.29.0.1-1ubuntu0.39.0.1-1ubuntu0.49.0.1-1ubuntu0.59.0.1-1ubuntu0.69.0.1-1ubuntu0.7
None known
pillow
Ubuntu:24.04:LTS
All versions, plus listed versions
10.0.0-110.1.0-110.2.0-110.2.0-1build110.2.0-1ubuntu1
Show 4 moreShow less
10.2.0-1ubuntu1.210.2.0-1ubuntu1.310.2.0-1ubuntu1.410.2.0-1ubuntu1.5
None known
pillow
Ubuntu:26.10
All versions, plus listed versions
12.1.1-2ubuntu112.3.0-1ubuntu112.3.0-1ubuntu2
None known
pillow
Ubuntu:26.04:LTS
All versions, plus listed versions
11.3.0-1ubuntu111.3.0-1ubuntu212.0.0-1ubuntu112.1.1-1ubuntu112.1.1-2ubuntu1
Show 5 moreShow less
12.1.1-2ubuntu1.112.1.1-2ubuntu1.212.1.1-2ubuntu1.312.1.1-2ubuntu1.412.1.1-2ubuntu1.5
None known
python-Pillow
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
before 11.3.0-160000.9.1
11.3.0-160000.9.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases
affectedOSV
affected
affectedOSV
affectedOSV
affectedOSV
Show 6 moreShow less
History
RecordedChangedSources
affectedOSV
affected, factsOSV
affectedOSV
affected, aliases, referencesOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96637 is a high vulnerability (CVSS 7.1) in Python Pillow, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in pillow 13.0.0.

References

Show 86 moreShow less
This page doesn't list everything

Left out here: 57 versions and the rest of 2 source descriptions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open