ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-96638

Pillow is a Python imaging library.

Published Oct 21, 2026 · catalog updated Oct 22, 2026 · Pillow is a Python

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-96638. EPSS is 0.34%. Act only if a listed version of Pillow is a Python is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Pillow is a Python).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Version ranges on file
Affected products
pip pillow · pypi pillow

## Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. ## Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) ## Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray with dest_length = xsize*ysize, looping . The loop condition is only checked at the TOP; individual branches append attacker-controlled amounts UNBOUNDED by dest_length: - delta escape (line 370): data += b"\x00" * (right + up * self.state.xsize) with right,up in 0..255 -> up to ~255*xsize bytes in ONE iteration. - absolute mode (line 385): data += bytes_read (up to 255). Because a single delta can push len(data) to ~256 * (row size), a tiny RLE stream combined with a large-but-legal xsize (xsize*ysize just under MAX_IMAGE_PIXELS, ~89M) yields a multi-GB bytearray (then copied again by bytes(data) and set_as_raw). No heap OOB (bytearray/set_as_raw are bounds-safe), but a severe memory-amplification DoS: the attacker file stays tiny. ## Reproduction Python 3.13, Pillow HEAD e7a7ea84 Attached: pillow_poc_bmp_rle_dos.py A 1084-byte BMP (BI_RLE8, width=3,000,000, height=1 -> 3M px, passes bomb check) with one delta escape (00 02 00 150) produces ~429 MB ; measured peak RSS 911 MB. Scaling width toward the bomb limit and up=255 produces tens of GB from a ~1 KB file. ## Suggested fix Cap growth at dest_length in the delta and absolute branches, e.g. clamp the delta fill to (dest_length - len(data)) and stop appending once len(data) >= dest_length; reject deltas that would move the cursor beyond the image, matching the existing per-row clamp at line 341-343. Credit: Yazan Balawneh - CyStack Security Team (GitHub: sonicnew) [pillow_poc_bmp_rle_dos.py](https://github.com/user-attachments/files/30244974/pillow_poc_bmp_rle_dos.py)

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip pillow>= 9.1.0, < 13.0.0
  • pypi pillowversion unspecified

How to fix CVE-2026-96638

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96638. EPSS is 0.34%. Act only if a listed version of Pillow is a Python is installed.

Which versions are affected?

Compare what you have installed with >= 9.1.0, < 13.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Pillow security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · NIST NVD

    Detected

    Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds

  2. Oct 22, 2026 · GitHub Advisory Database

    Updated

    ## Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. ## Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) ## Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray with dest_length = xsize*ysize,

Sources

  • CVE.orgVulnerability recordCVE-2026-96638

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-96638

    30-day exploitation probability 0.34%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-24rc-8hj2-v98c

    Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-96638

    BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches.

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-96638

    Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image row

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 28, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • CVE.orgOct 22, 2026
  • NIST NVDOct 22, 2026