ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-96639

Pillow is a Python imaging library.

Published Oct 21, 2026 · catalog updated Oct 28, 2026 · Pillow is a Python

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-96639. EPSS is 0.66%. Act only if a listed version of Pillow is a Python is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Pillow is a Python).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.66%
Remediation
Version ranges on file
Affected products
PyPI pillow · package pip · pip Pillow · pypi pillow · vendor python-pillow

### Summary Pillow multi-frame image loaders can retain native storage allocated for one frame while changing the Python-side image and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as , and a later frame of the same dimensions switches to a wider mode such as or , Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented + path. ### Details The root cause appears to be that only reallocates native storage when . It does not verify that the retained native storage still matches and . Several multi-frame / paths can update and decoder tiles for a later frame without invalidating . The decoder then writes or reads according to the new frame mode while the native storage still belongs to the old frame mode. Verified affected surfaces: 1. **PSD** can switch from grayscale/native storage to RGB layer decoding while retaining . This produces attacker-controlled native out-of-bounds writes and reliable crashes. 2. **MPO/JPEG** A crafted two-frame MPO can make frame 0 allocate storage, then make frame 1 decode / data into the retained storage. The documented path reaches this with . Verified native memory corruption, crash, over-read behavior, and scoped harmless-marker command execution on Pillow 12.3.0. 3. **DCX** calls , which changes mode/tile state without a native-storage mode guard. A crafted DCX with then PCX frames produces retained-storage mismatch and crash. 4. **MIC** MIC can call directly and bypass TIFF's normal guarded behavior. With a -based reachable frame transition, this produces retained-storage mismatch and crash. TIFF appears to be a useful positive control because its path checks both size and mode before reusing storage. ### Impact - process crash / denial of service, - native out-of-bounds write, - native over-re

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI pillow11.0.0 → 13.0.0
  • package pipversion unspecified
  • pip Pillow>= 11.0.0, < 13.0.0
  • pypi pillowversion unspecified
  • vendor python-pillowversion unspecified

How to fix CVE-2026-96639

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96639. EPSS is 0.66%. Act only if a listed version of Pillow is a Python is installed.

Which versions are affected?

Compare what you have installed with Pillow >= 11.0.0, < 13.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-125: Out-of-bounds Read; CWE-787: Out-of-bounds Write. EPSS 0.66%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Pillow security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · NIST NVD

    Detected

    Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. C

  2. Oct 22, 2026 · EUVD

    Updated

    Pillow multi-frame loaders can reuse stale native image storage after mode transitions

  3. Oct 28, 2026 · PyPA Advisory Database

    Fix available

    pillow fixed in 13.0.0

  4. Oct 28, 2026 · PyPA Advisory Database

    Fix available

    pillow fixed in 13.0.0

  5. Oct 28, 2026 · PyPA Advisory Database

    Updated

    ### Summary Pillow multi-frame image loaders can retain native storage allocated for one frame while changing the Python-side image and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as , and a later frame of the same dimensions switches to a wider mode such as or , Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-b

Sources

  • CVE.orgVulnerability recordCVE-2026-96639

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-96639

    30-day exploitation probability 0.66%

    first.org
  • EUVDVulnerability recordEUVD-2026-107573

    Pillow multi-frame loaders can reuse stale native image storage after mode transitions

    euvd.enisa.europa.eu
  • GitHub Advisory DatabasePackage advisoryGHSA-v9pv-5gc8-w2m6

    Pillow multi-frame loaders can reuse stale native image storage after mode transitions

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-96639

    Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes n

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-96639

    Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_p

    nvd.nist.gov
  • PyPA Advisory DatabasePackage advisoryGHSA-v9pv-5gc8-w2m6

    Pillow multi-frame loaders can reuse stale native image storage after mode transitions

    osv.dev
  • Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-PILLOW-21460715

    Out-of-bounds Write

    security.snyk.io
  • Tenable CVE DatabaseVulnerability recordCVE-2026-96639

    Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. C

    tenable.com
  • urlscan.ioThreat intelligenceCVE-2026-96639
    urlscan.io

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • urlscan.ioOct 31, 2026
  • Tenable CVE DatabaseOct 30, 2026
  • PyPA Advisory DatabaseOct 28, 2026
  • FIRST EPSSOct 28, 2026
  • Snyk Vulnerability DatabaseOct 26, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • EUVDOct 22, 2026
  • CVE.orgOct 22, 2026
  • NIST NVDOct 22, 2026